Accessing the UI via tunnel

Configuration
1

I have a Raspberry Pi 3 with the latest Home Assistant OS installed and an Ubuntu Server on a VPS with a static IP assigned to it. What I want is a tunnel from the Ubuntu server to Home Assistant with something like Wire Guard and access to its Web UI. I tried installing Wire Guard on both and the connection seems OK but I can’t get any data from Home Assistant on port 8123. Is there any other software that can work self-contained or any way to make Wire Guard work?

2

If the 2 devices can ping each other on the wireguard interface, then it does work.
Now, what are you trying to achieve, exactly? Do you use your VPS Ubuntu as a cloud desktop?

Stating the obvious (too little information to know what you already tried), but you’d have to use the wireguard address, here, not something like “homeassistant.local”

3

Andreas Spiess Zerotier
Try this link. It seems to make things easier than configuring Wireguard. I have been using wireguard for few years on my router. Any problems I had setting it up was due to firewall rules.

4

They can ping but when I send curl to the 8123 port, I get nothing.

I want to forward incoming connections from the Ubuntu server to Home Assistant and access the Home Assistant via the public static IP of the Ubuntu server.

I configured the Ubuntu server as 10.0.0.1 and Home Assistant as 10.0.0.2

bash~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc fq_codel state UP group default qlen 1000
    link/ether 12:c2:2a:05:e7:d5 brd ff:ff:ff:ff:ff:ff
    inet 172.31.95.41/20 metric 100 brd 172.31.95.255 scope global dynamic eth0
       valid_lft 3352sec preferred_lft 3352sec
    inet6 fe80::10c2:2aff:fe05:e7d5/64 scope link 
       valid_lft forever preferred_lft forever
5: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 8921 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet 10.0.0.1/24 scope global wg0
       valid_lft forever preferred_lft forever

bash~$ ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=142 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=142 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=142 ms
64 bytes from 10.0.0.2: icmp_seq=4 ttl=64 time=142 ms
64 bytes from 10.0.0.2: icmp_seq=5 ttl=64 time=142 ms
64 bytes from 10.0.0.2: icmp_seq=6 ttl=64 time=142 ms
^C
--- 10.0.0.2 ping statistics ---
7 packets transmitted, 6 received, 14.2857% packet loss, time 6009ms
rtt min/avg/max/mdev = 141.628/141.809/142.029/0.145 ms

bash~$ curl -I 10.0.0.2:8123
curl: (7) Failed to connect to 10.0.0.2 port 8123 after 142 ms: Connection refused
5

HA doesn’t support HEAD, but that’s another story.

❯ curl -I ha.lan:8123
HTTP/1.1 405 Method Not Allowed
Content-Type: text/plain; charset=utf-8
Allow: GET
Content-Length: 23
Date: Sun, 02 Jul 2023 09:38:52 GMT
Server: Python/3.11 aiohttp/3.8.4

Assuming HA works from your network, smells like a firewall issue.
How is HA installed? Is 8123 opened/forwarded for wg0?

6

I installed the system using Raspberry Pi Imager with a ready-to-use Home Assistant OS image. And for Wire Guard, I just installed the addon and applied my own configuration.

UFW is disabled on the Ubuntu server. So Home Assistant needs a firewall config, right?

Wire Guard addon doesn’t configure this automatically? Do I need to set up forwarding manually?

IDK if it helps but here is my config for the Wire Guard addon:

server:
  host: homeassistant.local
  addresses:
    - 10.0.0.2/32
  dns: []
  private_key: <HASS private key>
  public_key: <HASS public key>
peers:
  - name: ubuntu-server
    public_key: <Ubuntu server public key>
    endpoint: 44.203.119.30:51820
    addresses:
      - 10.0.0.1/24
    allowed_ips: []
    client_allowed_ips:
      - 10.0.0.1

And here is the config for the Ubuntu server:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <Ubuntu server private key>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <HASS public key>
AllowedIPs = 10.0.0.2/32

I removed the keys just before posting, they work without problem.

7

Ok, so it should just work.
Maybe check the HA logs for errors.