How to configure netmasks etc correctly on HAOS

Configuration
1

I used to have HAOS relatively fine tuned and performant.

After I had a disk failure and needed to get a restore, followed by a few config tweaks, etc, I noticed a couple of things:

  • some disconnects when using the ssh terminal addon (reconnect works, but it is happening every few secs)
  • I am also no longer able to access ha from the internet via https
  • I also seem to get occasional slow response on the UI.

I spent a bit of time trying different things with the nginx and duckdns addons and just wondered whether anything changed in the core over the last three months that would require an nginx change.

I can access home assistant via http on port 8123 (without ssl), the ssh terminal addon works, etc. Just wondering whether I could have missed anything.

Summary of ifconfig:

enp1s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.11  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::99d9:1dbe:b4b7:73e0  prefixlen 64  scopeid 0x20<link>

hassio: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.30.32.1  netmask 255.255.254.0  broadcast 172.30.33.255
        inet6 fd0c:ac1e:2100::1  prefixlen 48  scopeid 0x0<global>
        inet6 fe80::f4b1:6dff:fefb:523b  prefixlen 64  scopeid 0x20<link>

An excerpt of my network config (docker network inspect hassio). Just wondering whether this looks normal:

   {
        "Name": "hassio",
        "Id": "xxxx",
        "Created": "2026-07-27T11:06:22.261842452Z",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv4": true,
        "EnableIPv6": true,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.30.32.0/23",
                    "IPRange": "172.30.33.0/24",
                    "Gateway": "172.30.32.1"
                },
                {
                    "Subnet": "fd0c:ac1e:2100::/48",
                    "Gateway": "fd0c:ac1e:2100::1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Options": {
            "com.docker.network.bridge.name": "hassio"
        },
        "Labels": {},
        "Containers": {
            "xyxyx": {
                "Name": "hassio_cli",
                "EndpointID": "yyyy",
                "MacAddress": "6a:9c:af:94:cc:b1",
                "IPv4Address": "172.30.32.5/23",
                "IPv6Address": "fd0c:ac1e:2100::4/48"
            },
            "yyyyy": {
                "Name": "app_core_duckdns",
                "EndpointID": "yyyyyyxxx",
                "MacAddress": "9e:05:8f:ad:2e:d1",
                "IPv4Address": "172.30.33.2/23",
                "IPv6Address": "fd0c:ac1e:2100::9/48"
            },
            "xxxxyy": {
                "Name": "app_core_nginx_proxy",
                "EndpointID": "yyyyyyxxy",
                "MacAddress": "56:80:d2:48:a2:03",
                "IPv4Address": "172.30.33.4/23",
                "IPv6Address": "fd0c:ac1e:2100::b/48"
            },
            "zzz": {
                "Name": "hassio_supervisor",
                "EndpointID": "zzzyy",
                "MacAddress": "7e:ed:12:a4:2f:08",
                "IPv4Address": "172.30.32.2/23",
                "IPv6Address": "fd0c:ac1e:2100::3/48"
            },
        },
        "Status": {
            "IPAM": {
                "Subnets": {
                    "172.30.32.0/23": {
                        "IPsInUse": 14,
                        "DynamicIPsAvailable": 249
                    },
                    "fd0c:ac1e:2100::/48": {
                        "IPsInUse": 13,
                        "DynamicIPsAvailable": 18446744073709551615
                    }
                }
            }
        }
    }
]
  • Installation method Home Assistant OS
  • Core 2026.8.1
  • Supervisor 2026.07.5
  • Operating System 18.1
  • Frontend 20260729.6

Nginx config:

domain: xxyy.duckdns.org

hsts: max-age=31536000; includeSubDomains
certfile: fullchain.pem
keyfile: privkey.pem
cloudflare: false
use_ssl_backend: true
client_max_body_size_megabytes: 1
customize:
  active: false
  default: nginx_proxy_default*.conf
  servers: nginx_proxy/*.conf
real_ip_from:
  - 172.30.32.0/23

duckdns addon config (when I run it, it reports the certificates are up to date and does not rebuilt):

domains:
  - xxx.duckdns.org
token: xyz
aliases: []
lets_encrypt:
  accept_terms: true
  algo: rsa
  certfile: fullchain.pem
  keyfile: privkey.pem
seconds: 300

The selected https and http ports are mapped on the internet routers.

the homeassistant.yaml includes:

http:
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem
  ip_ban_enabled: true
  use_x_forwarded_for: true 
  trusted_proxies:
    - 172.30.32.0/23
2

I read that as it’s working, but I don’t know what it’s doing exactly. Teach me what’s happening.

Do I understand correctly?

3

As of v2026.8.0 the http section is now set up in the UI.

4

There is slow connectivity, every few secs I get timeout when using the ssh/terminal addon. I am also not able to connect from the internet using the duckdns address and the certificates. And this used to work.

I will now change the setup, as per the other suggestion (to change the http section, moving it to the UI config) and see how it works

5

Thanks, I removed those ssl settings (from the config and also the UI), but it made no difference.
I am still not able to connect from the internet.
I see that this is now fully set via the UI.
When I activate the ssl connection, I cannot connect from the app. I can connect from a local browser, but only when accepting the messages telling me I am connecting to a local server without a certificate matching the dns address.

6

You just deleted your http configuration completely. No wonder it can’t connect.

Put the UI config back.

7

I did two tests:

  • without ssl on home assistant but using nginx with ssl. This did not allow connection from the internet but i can connect locally with http both browser and via app
  • Directly using ssl on home assistant. This still did not allow connection from the internet. When using a browser to connect to the local ip address, I can override warnings and connect. But of course does not work using the app, even locally. There does not seem to be an option to override the warning on certificates not matching

How can I diagnose what the issue is? I do not see any error messages, etc

8

To make it clear, my understanding is the config is now on the UI, not in the file. So I moved the http config to the UI

9

I am still experiencing many instances where a local HA app or even a local web browser session to home assistant is not very responsive with a few secs delay.

HAOS cpu usage is usually below 10%, with ocasional spikes to around 40%. memory usage is stable at around 40%, so I cannot see what else could be causing it and what else to look into.