It’s unnecessary if you don’t mind using the Tailscale app to establish the remote-access connection.
If you don’t want to use the app, and don’t mind exposing your Home Assistant system to the Internet, then Tailscale’s Funnel feature is an alternative way of providing remote-access (refer to parhelion’s instructions).
I don’t mind if using the app is more secure.
I have two machines set up and connected in tailscale admin page (my pc on lan & my android via mobile data) but neither can connect to HA via tailscale with provided addresses. Both connect fine with local login and wifi.
What am doing wrong?
I suggest creating a new topic to discuss the problem in order to keep the discussion separate from this one (which is about using Tailscale’s Funnel feature).
Hi there,
I used DuckDNS in the past and wanted to switch to tailscale. I tought it would be a good idea to remove the DuckDNS app first and install tailscale then. But somehow it did not work this way. In the machines section of tailscale, the green funnel logo did not come up. And yes, I checked the funnel box and save the configuration of the app before I started the app. I added the code snippet to tailscales access control JSON file within the curly brackets.
// Added for Homeassistant 20.04.2026
"nodeAttrs": [
{
"target": ["autogroup:member"],
"attr": ["funnel"],
},
],
// Test access rules every time they're saved.
// "tests": [
// {
// "src": "[email protected]",
// "accept": ["tag:example"],
// "deny": ["100.101.102.103:443"],
// },
// ],
}
I noted some existing code in the http section of my configuration.yaml when I added the nessesary snippet for tailscale. I think it was for DuckDNS but I am not sure what to do with it.
http:
use_x_forwarded_for: true
trusted_proxies:
- 127.0.0.1
ssl_certificate: /ssl/fullchain.pem
ssl_key: /ssl/privkey.pem
cors_allowed_origins:
- https://google.com
- https://home-assistant.io
ip_ban_enabled: true
login_attempts_threshold: 5
The ssl_certificate and the ssl_key do exist in the ssl folder.
Is there a way to subsequently enable the funnel function?
Do I have to delete the old http entries and their associated files?
Thank you in advance for your assistance.
I managed to solve it myself.
The rest was a piece of cake.
This is a fantastic guide, clear and detailed. Thank you! I can't wait to try it.
I have been using DuckDNS for about a year, and it has mostly worked fine, until recently, when it started acting strange. Even before, I have never been able to use my local address in the Companion App because the certificate was not recognized. Now, locally the DuckDNS address stopped being recognized.
Following guides on the web and chats with AI, I tried adding NGINX and forwarding ports (443 and 80) without success. I can still access Ha locally, and now I'm at a point where I can only use DuckDNS without SSL. So I'm looking for better options, and Tailscale Funnel seems to be it.
Just to clarify, after creating a backup (which I do every day, but still), I should:
1-remove NGINX from HA
2-remove DuckDNS from HA
3-follow the guide above
4-change the local address in the Companion app to http://homeassistant.local:8123 (right?)
5-change the remote address in the Companion App to the Taiscale address (right?)
In the past, I had problems with IPV6 so I had completely removed that from Home Assistant. I don't remember if it was linked to DuckDNS specifically. Is it a problem to use only IPV4?
Thanks!
#4 - This, to be clear, would be the "Internal connection URL" field. And I would just use http://<your-local-ipv4>:8123 instead, for when you are on you home wifi & not on Tailscale VPN.
#5 - This would be the "Home Assistant URL" field, using https://<device_name>.<your-tailnet-name>.ts.net for when you are not on your home wifi.
I use IPV4 only also.
Also, for me, in the end, I chose not using funnel - only because I don't even want to expose https://<my_ha_device_name>.<my-tailnet-name>.ts.net to the wild wild internet... just as what people have discussed earlier in this thread. But I digress.
Thanks for confirming my understanding makes sense. I appreciate it!
Also, I forgot to mention that I should remove port forwarding from my router.
I understand the issues discussed regardig security. Using funnel brings me back to the same level as HTTPS with DuckDNS, essentially, I'm ok with that, and using VPNs on every phone in the family is a great way to kill any approval factor I might currently have 
Hi everyone, I set up the Tailscale app with funnels on my HA. The remote connection works using a URL like: https://homeassistant.tailxyz.ts.net, the problem is that it often doesn’t work, I can’t reach it, neither from my PC browser nor using the HA app on my Android smartphone. Why? Are you having these problems too? Is there a more reliable solution (still free?)
Back again.
I configured the Tailscape funnel this morning. After several reboots, approving the subnet and Exit node in the Machines tab of the Tailscape admin page, more reboots, I finally saw the TLS certificate appear with a 3 months validity. Yet another reboot let me connect to HA using the tailspace domain name. But only locally! When using, say, data from my mobile phone, I cannot connect, even when explicitly writing https:// before the domain.
I have not opened any ports in my router, should I?
I have added 127.0.0.1 in the trusted proxies as requested. I had been told before to also have my local IP, I let that there, is it a good idea?
Anything else to do in order to make it work?
EDIT : it started working all by itself. I guess what it needed was time. I leave this here for anyone who'd wonder what's going on with their setup.
I think this is exactly what I need but I’m a little confused. I have 4 ‘machines’ in my Tailscale network. When I looked at your procedure, especially the part regarding the ACLs, I don’t know how it distinguishes to which node this applies.
For example, I want to expose my HA server only and not the entire Tailscale network. The whole reason I want to do this is for remote access via the companion app without loading a Tailscale app AND to enable Amazon Alexa to be able to control my devices in my home with voice commands.
Is this the correct solution for me? Appreciate your guidance here.
I just restarted everything and it’s working. I’m hoping that Alexa can now control my devices with the account linking.
I’m getting this warning on HA regarding the http snippet in the yaml file.
This stops working in version 2027.2.0. Please address before upgrading.
I’m pretty sure that the docs (OP) will need to be updated before that date, but the concept should still work. The YAML should’ve been migrated automatically to UI network settings panel, including the trusted_proxies and use_x_forwarded_for which is what is needed.
I can confirm the setup of the Tailscale Funnel works well, ensuring that:
I followed the guide in detail. Tailscale is succesfully showing the server as connected, but the hass app is giving me the following error. Not sure where to look anymore.
Hope anybody can give me some help.
LOG:
2026/09/01 16:10:47 control: controlhttp: forcing port 443 dial due to recent noise dial
2026/09/01 16:18:51 localapi: [POST] /localapi/v0/upload-client-metrics
2026/09/01 16:18:51 localapi: [POST] /localapi/v0/upload-client-metrics
2026/09/01 16:18:51 localapi: [POST] /localapi/v0/debug-packet-filter-rules
2026/09/01 16:18:56 localapi: [POST] /localapi/v0/debug-packet-filter-rules
2026/09/01 16:21:27 [RATELIMIT] format("%s: %s %d %s\n%s") (5 dropped)
2026/09/01 16:21:27 Drop: TCP{[xxxxxxxxxxx]:50040 > [xxxxxxxxxxx} 80 no rules matched
2026/09/01 16:21:29 Drop: TCP{[xxxxxxxxxxx]:17069 > [xxxxxxxxxxx} 80 no rules matched
2026/09/01 16:21:29 [RATELIMIT] format("%s: %s %d %s\n%s")
2026/09/01 16:21:31 http: TLS handshake error from [xxxxxxxxxxx]:17069: EOF
2026/09/01 16:21:31 http: TLS handshake error from [xxxxxxxxxxx]:16887: EOF
2026/09/01 16:21:32 http: TLS handshake error from [xxxxxxxxxxx]:48038: EOF
2026/09/01 16:21:34 http: TLS handshake error from [xxxxxxxxxxx]:42449: tls: client requested unsupported application protocols (["http/0.9" "http/1.0" "spdy/1" "spdy/2" "spdy/3" "h2c" "hq"])
2026/09/01 16:21:35 [RATELIMIT] format("%s: %s %d %s\n%s") (5 dropped)
2026/09/01 16:21:35 Drop: TCP{[xxxxxxxxxxx]:32377 > [xxxxxxxxxxx} 80 no rules matched
2026/09/01 16:21:36 http: TLS handshake error from [xxxxxxxxxxx]:32377: tls: client requested unsupported application protocols (["hq" "h2c" "spdy/3" "spdy/2" "spdy/1" "http/1.0" "http/0.9"])
2026/09/01 16:21:36 Drop: TCP{[xxxxxxxxxxx]:49392 > [xxxxxxxxxxx} 80 no rules matched
2026/09/01 16:21:36 [RATELIMIT] format("%s: %s %d %s\n%s")
2026/09/01 16:21:37 http: TLS handshake error from [xxxxxxxxxxx]:49392: tls: client offered only unsupported versions: [302 301]
2026/09/01 16:21:40 http: TLS handshake error from [xxxxxxxxxxx]:19248: EOF
2026/09/01 16:21:41 http: TLS handshake error from [xxxxxxxxxxx]:20472: EOF
2026/09/01 16:21:42 http: TLS handshake error from [xxxxxxxxxxx]:36453: tls: no cipher suite supported by both client and server; client offered: [16 33 67 c09e c0a2 9e 39 6b c09f c0a3 9f 45 be 88 c4 9a c008 c009 c023 c0ac c0ae c02b c00a c024 c0ad c0af c02c c072 c073 cca9 cc14 c007 c012 c013 c027 c02f c014 c028 c030 c060 c061 c076 c077 cca8 cc13 c011 a 2f 3c c09c c0a0 9c 35 3d c09d c0a1 9d 41 ba 84 c0 7 4 5]
2026/09/01 16:21:44 http: TLS handshake error from [xxxxxxxxxxx]:53598: EOF
2026/09/01 16:22:07 localapi: [POST] /localapi/v0/debug-packet-filter-rules
2026/09/01 16:22:36 localapi: [POST] /localapi/v0/debug-packet-filter-rules
I have trouble accessing HS via Tailscale and Funnel when I’m away from home. It works if I activate the Tailscale VPN, but without the VPN connected, it sometimes connects and sometimes doesn’t. What could be causing this? The address looks like this: https://homeassistant.xyz.ts.net/.
Under trusted proxies, I’ve entered:
127.0.0.1/32
100.64.0.0/10
::1/128
thanks