Home Assistant with Dual Network Access (Local & VPN via VPS) – Is It Possible?

Installation
,
1

Dear Home Assistant Community,

I’m currently working on a secure remote access solution for my Home Assistant setup and I’d love to get your insights before implementing it fully.

:hammer_and_wrench: My Goal

I want to achieve secure remote access to Home Assistant while keeping my local access fully functional. Here’s the architecture I’m aiming for:

  1. Local Access:
  • When I’m at home, I want to access Home Assistant via my local network (192.168.1.X).
  • Even if my internet connection goes down, I still need Home Assistant to be accessible via WiFi/LAN.
  1. Remote Access (Secure):
  • I do not want to expose Home Assistant directly to the internet (no open ports on my router).
  • Instead, I have a VPS with a fixed public IP running WireGuard VPN.
  • Only the VPS will be able to access Home Assistant via a WireGuard tunnel (10.0.0.2).

:light_bulb: My Proposed Configuration

To achieve this, I plan to configure Home Assistant to listen on both interfaces:

  • Local network (192.168.1.100)
  • WireGuard VPN tunnel (10.0.0.2)

Here’s the configuration.yaml setup I’m considering:

http:
  server_host:
    - 192.168.1.100  # Local network access
    - 10.0.0.2       # VPN access via VPS
  use_x_forwarded_for: true
  trusted_proxies:
    - 10.0.0.1  # VPS WireGuard address

To secure this, I would also configure my firewall (ufw) to:
:white_check_mark: Allow local access (192.168.1.0/24)
:white_check_mark: Allow remote access only from the VPS (10.0.0.1 → 10.0.0.2)
:cross_mark: Block direct access from the internet

:red_question_mark: My Question to the Community

Before implementing this setup, I’d like to confirm whether Home Assistant can properly handle two different IP addresses for access (one for local and one for VPN).

  • Has anyone successfully configured Home Assistant with two listening IPs?
  • Are there any known issues or conflicts when setting this up?
  • Do you recommend any additional security improvements (SSL, 2FA, …)?

I appreciate any insights or feedback you can provide! Thanks in advance for your help. :blush::rocket:

2

You didn’t mention what type of HA install you are planning: core (python app), docker, or HAOS. Since you mention ufw I’m guessing it’s one of the first two.

I can confirm that, at least for docker container with network_mode = host, HA listens on all NICs by default (i.e. no need for server_host directive). In fact if you left the server_host directive in your config, I’d be unsure what would happen if HA is started while that tunnel interface is down, so it may be more robust without it. Also if you’re using docker keep in mind you may need a firewall fix for ufw to work.

Despite not port forwarding your router, it sure sounds like your tunnel is still effectively exposing HA directly on the internet. A reverse proxy on the VPS can help, but only if it is also well-hardened and running utilities like web application firewalls, fail2ban, and geo-ip blockers. 2FA is advisable since you will get brute-force attacks, so better hope there aren’t any zero-days lurking. Depending on your use case, it might be simpler, and much more secure, to run the wireguard client app on your mobile device instead of on a VPS.

3

Hi peterxian,

Thanks for your answer and your info.

The HA install I’m thinking about is the Oracle VM on a Windows machine (VirtualBox).

I’m not an IT guy :sweat_smile:

As I understand I need to review the cybersecurity around my VPS (firewall, fail2ban, and geo-ip blockers) and 2FA for HA

The idea is to try to put my remote devices without any additional software in it (VPN or any other app). Today I simply use ZeroTier on my smartphone.