It’s unnecessary if you don’t mind using the Tailscale app to establish the remote-access connection.
If you don’t want to use the app, and don’t mind exposing your Home Assistant system to the Internet, then Tailscale’s Funnel feature is an alternative way of providing remote-access (refer to parhelion’s instructions).
I don’t mind if using the app is more secure.
I have two machines set up and connected in tailscale admin page (my pc on lan & my android via mobile data) but neither can connect to HA via tailscale with provided addresses. Both connect fine with local login and wifi.
What am doing wrong?
I suggest creating a new topic to discuss the problem in order to keep the discussion separate from this one (which is about using Tailscale’s Funnel feature).
Hi there,
I used DuckDNS in the past and wanted to switch to tailscale. I tought it would be a good idea to remove the DuckDNS app first and install tailscale then. But somehow it did not work this way. In the machines section of tailscale, the green funnel logo did not come up. And yes, I checked the funnel box and save the configuration of the app before I started the app. I added the code snippet to tailscales access control JSON file within the curly brackets.
// Added for Homeassistant 20.04.2026
"nodeAttrs": [
{
"target": ["autogroup:member"],
"attr": ["funnel"],
},
],
// Test access rules every time they're saved.
// "tests": [
// {
// "src": "[email protected]",
// "accept": ["tag:example"],
// "deny": ["100.101.102.103:443"],
// },
// ],
}
I noted some existing code in the http section of my configuration.yaml when I added the nessesary snippet for tailscale. I think it was for DuckDNS but I am not sure what to do with it.
http:
use_x_forwarded_for: true
trusted_proxies:
- 127.0.0.1
ssl_certificate: /ssl/fullchain.pem
ssl_key: /ssl/privkey.pem
cors_allowed_origins:
- https://google.com
- https://home-assistant.io
ip_ban_enabled: true
login_attempts_threshold: 5
The ssl_certificate and the ssl_key do exist in the ssl folder.
Is there a way to subsequently enable the funnel function?
Do I have to delete the old http entries and their associated files?
Thank you in advance for your assistance.
I managed to solve it myself.
The rest was a piece of cake.
This is a fantastic guide, clear and detailed. Thank you! I can't wait to try it.
I have been using DuckDNS for about a year, and it has mostly worked fine, until recently, when it started acting strange. Even before, I have never been able to use my local address in the Companion App because the certificate was not recognized. Now, locally the DuckDNS address stopped being recognized.
Following guides on the web and chats with AI, I tried adding NGINX and forwarding ports (443 and 80) without success. I can still access Ha locally, and now I'm at a point where I can only use DuckDNS without SSL. So I'm looking for better options, and Tailscale Funnel seems to be it.
Just to clarify, after creating a backup (which I do every day, but still), I should:
1-remove NGINX from HA
2-remove DuckDNS from HA
3-follow the guide above
4-change the local address in the Companion app to http://homeassistant.local:8123 (right?)
5-change the remote address in the Companion App to the Taiscale address (right?)
In the past, I had problems with IPV6 so I had completely removed that from Home Assistant. I don't remember if it was linked to DuckDNS specifically. Is it a problem to use only IPV4?
Thanks!
#4 - This, to be clear, would be the "Internal connection URL" field. And I would just use http://<your-local-ipv4>:8123 instead, for when you are on you home wifi & not on Tailscale VPN.
#5 - This would be the "Home Assistant URL" field, using https://<device_name>.<your-tailnet-name>.ts.net for when you are not on your home wifi.
I use IPV4 only also.
Also, for me, in the end, I chose not using funnel - only because I don't even want to expose https://<my_ha_device_name>.<my-tailnet-name>.ts.net to the wild wild internet... just as what people have discussed earlier in this thread. But I digress.
Thanks for confirming my understanding makes sense. I appreciate it!
Also, I forgot to mention that I should remove port forwarding from my router.
I understand the issues discussed regardig security. Using funnel brings me back to the same level as HTTPS with DuckDNS, essentially, I'm ok with that, and using VPNs on every phone in the family is a great way to kill any approval factor I might currently have 
Hi everyone, I set up the Tailscale app with funnels on my HA. The remote connection works using a URL like: https://homeassistant.tailxyz.ts.net, the problem is that it often doesn’t work, I can’t reach it, neither from my PC browser nor using the HA app on my Android smartphone. Why? Are you having these problems too? Is there a more reliable solution (still free?)
Back again.
I configured the Tailscape funnel this morning. After several reboots, approving the subnet and Exit node in the Machines tab of the Tailscape admin page, more reboots, I finally saw the TLS certificate appear with a 3 months validity. Yet another reboot let me connect to HA using the tailspace domain name. But only locally! When using, say, data from my mobile phone, I cannot connect, even when explicitly writing https:// before the domain.
I have not opened any ports in my router, should I?
I have added 127.0.0.1 in the trusted proxies as requested. I had been told before to also have my local IP, I let that there, is it a good idea?
Anything else to do in order to make it work?
EDIT : it started working all by itself. I guess what it needed was time. I leave this here for anyone who'd wonder what's going on with their setup.
I think this is exactly what I need but I’m a little confused. I have 4 ‘machines’ in my Tailscale network. When I looked at your procedure, especially the part regarding the ACLs, I don’t know how it distinguishes to which node this applies.
For example, I want to expose my HA server only and not the entire Tailscale network. The whole reason I want to do this is for remote access via the companion app without loading a Tailscale app AND to enable Amazon Alexa to be able to control my devices in my home with voice commands.
Is this the correct solution for me? Appreciate your guidance here.
I just restarted everything and it’s working. I’m hoping that Alexa can now control my devices with the account linking.
I’m getting this warning on HA regarding the http snippet in the yaml file.
This stops working in version 2027.2.0. Please address before upgrading.
I’m pretty sure that the docs (OP) will need to be updated before that date, but the concept should still work. The YAML should’ve been migrated automatically to UI network settings panel, including the trusted_proxies and use_x_forwarded_for which is what is needed.
I can confirm the setup of the Tailscale Funnel works well, ensuring that:
I followed the guide in detail. Tailscale is succesfully showing the server as connected, but the hass app is giving me the following error. Not sure where to look anymore.
Hope anybody can give me some help.
LOG:
2026/09/01 16:10:47 control: controlhttp: forcing port 443 dial due to recent noise dial
2026/09/01 16:18:51 localapi: [POST] /localapi/v0/upload-client-metrics
2026/09/01 16:18:51 localapi: [POST] /localapi/v0/upload-client-metrics
2026/09/01 16:18:51 localapi: [POST] /localapi/v0/debug-packet-filter-rules
2026/09/01 16:18:56 localapi: [POST] /localapi/v0/debug-packet-filter-rules
2026/09/01 16:21:27 [RATELIMIT] format("%s: %s %d %s\n%s") (5 dropped)
2026/09/01 16:21:27 Drop: TCP{[xxxxxxxxxxx]:50040 > [xxxxxxxxxxx} 80 no rules matched
2026/09/01 16:21:29 Drop: TCP{[xxxxxxxxxxx]:17069 > [xxxxxxxxxxx} 80 no rules matched
2026/09/01 16:21:29 [RATELIMIT] format("%s: %s %d %s\n%s")
2026/09/01 16:21:31 http: TLS handshake error from [xxxxxxxxxxx]:17069: EOF
2026/09/01 16:21:31 http: TLS handshake error from [xxxxxxxxxxx]:16887: EOF
2026/09/01 16:21:32 http: TLS handshake error from [xxxxxxxxxxx]:48038: EOF
2026/09/01 16:21:34 http: TLS handshake error from [xxxxxxxxxxx]:42449: tls: client requested unsupported application protocols (["http/0.9" "http/1.0" "spdy/1" "spdy/2" "spdy/3" "h2c" "hq"])
2026/09/01 16:21:35 [RATELIMIT] format("%s: %s %d %s\n%s") (5 dropped)
2026/09/01 16:21:35 Drop: TCP{[xxxxxxxxxxx]:32377 > [xxxxxxxxxxx} 80 no rules matched
2026/09/01 16:21:36 http: TLS handshake error from [xxxxxxxxxxx]:32377: tls: client requested unsupported application protocols (["hq" "h2c" "spdy/3" "spdy/2" "spdy/1" "http/1.0" "http/0.9"])
2026/09/01 16:21:36 Drop: TCP{[xxxxxxxxxxx]:49392 > [xxxxxxxxxxx} 80 no rules matched
2026/09/01 16:21:36 [RATELIMIT] format("%s: %s %d %s\n%s")
2026/09/01 16:21:37 http: TLS handshake error from [xxxxxxxxxxx]:49392: tls: client offered only unsupported versions: [302 301]
2026/09/01 16:21:40 http: TLS handshake error from [xxxxxxxxxxx]:19248: EOF
2026/09/01 16:21:41 http: TLS handshake error from [xxxxxxxxxxx]:20472: EOF
2026/09/01 16:21:42 http: TLS handshake error from [xxxxxxxxxxx]:36453: tls: no cipher suite supported by both client and server; client offered: [16 33 67 c09e c0a2 9e 39 6b c09f c0a3 9f 45 be 88 c4 9a c008 c009 c023 c0ac c0ae c02b c00a c024 c0ad c0af c02c c072 c073 cca9 cc14 c007 c012 c013 c027 c02f c014 c028 c030 c060 c061 c076 c077 cca8 cc13 c011 a 2f 3c c09c c0a0 9c 35 3d c09d c0a1 9d 41 ba 84 c0 7 4 5]
2026/09/01 16:21:44 http: TLS handshake error from [xxxxxxxxxxx]:53598: EOF
2026/09/01 16:22:07 localapi: [POST] /localapi/v0/debug-packet-filter-rules
2026/09/01 16:22:36 localapi: [POST] /localapi/v0/debug-packet-filter-rules
I have trouble accessing HS via Tailscale and Funnel when I’m away from home. It works if I activate the Tailscale VPN, but without the VPN connected, it sometimes connects and sometimes doesn’t. What could be causing this? The address looks like this: https://homeassistant.xyz.ts.net/.
Under trusted proxies, I’ve entered:
127.0.0.1/32
100.64.0.0/10
::1/128
thanks
Can’t get it to work with the IOS APP?
With Tailscale ON, on my iPad (inside the LAN) and iPhone (cellular) using a browser I can connect to my HA.
Also tried settings external URL https://homeassistant.xyz.ts.net:8123
Under trusted proxies, I’ve entered:
127.0.0.1/32
Also added my local HA IP without luck.
But using the IOS app I can’t connect on my LAN or cellular.
Any ideas?
{
“error” : “Token fetch failed (Alamofire.AFError: sessionTaskFailed(error: Error Domain=NSURLErrorDomain Code=-1005 "The network connection was lost." UserInfo={_kCFStreamErrorCodeKey=-4, NSUnderlyingError=0x132d0f9f0 {Error Domain=kCFErrorDomainCFNetwork Code=-1005 "(null)" UserInfo={NSErrorPeerAddressKey=<CFData 0x133f02dc0 [0x1f03c8fd8]>{length = 28, capacity = 28, bytes = 0x1c1e1fbb00000000fe80000000000000 … 3ff743f90d000000}, _kCFStreamErrorCodeKey=-4, _kCFStreamErrorDomainKey=4}}, _NSURLErrorFailingURLSessionTaskErrorKey=LocalDataTask <24F9CAB3-04C0-4E3A-BA57-25B953E40164>.<1>, _NSURLErrorRelatedURLSessionTaskErrorKey=(\n "LocalDataTask <24F9CAB3-04C0-4E3A-BA57-25B953E40164>.<1>"\n), NSLocalizedDescription=The network connection was lost., NSErrorFailingURLStringKey=http://homeassistant.local:8123/auth/token, NSErrorFailingURLKey=http://homeassistant.local:8123/auth/token, _kCFStreamErrorDomainKey=4}))”
}
I think I might be able to help.
Do you use Tailscale app on both th iPad (inside the LAN) and iPhone (cellular)? Does this mean “the Tailscale app on my iPad & iPhone saying Tailscale on”?
Or does this simply mean “my HA is on Tailscale using the HA Tailscale app”?
Or something else?
Also what’s the tailscale ip of your HA server?
That’s good. What is the url you are using, from the browser on iPad, and from the browser on iPhone? Are they the same browser same url, but one from LAN and the other from cell network?
Are you using the tailscale ip or the homeassistant.local in the url? Or something else?
If homeassistant.local, is it possible, from both iPad and iPhone, check which ip address the homeassistant.local would resolve?
Next,
Where did you do this exactly? Is it from yaml file? Which one? Or somewhere else?
Also are you on 2026.8 or .9 or .10?
Next,
Add your local HA IP to where exactly?
Which IP exactly? Is this Tailscale ip or some 192.168.aa.bb?
I have more questions, but the above are enough for now. Let us know, if you need some help.
I mean, without exact information the other users here could only guess, and I guess you have setup multiple things around Tailscale, in a way that some of them are conflicting to others.
Here is my setup:
Old router port forwarding, DuckDns rule is deleted, and router rebooted.
HA DuckDNS APP deleted, HA rebooted.
Status:
PC on my LAN, HA works fine in the browser Brave http://homeassistant:8123/.
iPhone cellular, works with browser Brave using IP https://homeassistant.XYZ.ts.net,
and Tailscale (VPN on),
iPhone cellular, HA App + Tailscale (VPN on),the HA App does not work. .
iPhone connected to my WiFi/LAN + Tailscale App (VPN off), the HA App does not work.
iPhone connected to my WiFi/LAN + Tailscale App (VPN on), the HA App does not work.
iPad connected to my WiFi/LAN + Tailscale App (VPN on), the HA App does not work.
Works using browser Brave with IP https://homeassistant.XYZ.ts.net
iPad connected to my WiFi/LAN + Tailscale App (VPN off), the HA App, does not work.
The HA App settings - > Servers -> homeassistant -> External URL:
https://homeassistant.XYZ.ts.net:8123
https://homeassistant.XYZ.ts.net
https://XYZ.ts.net:8123
https://XYZ.ts.net
-does not work
Looks like the HA App on my iPad/iPhone, cant connect at all.
HA - Tailscale App, configuration:
HA->Settings → System - > Network:
iPad/iPhone, Ha App Settings:
I have tried External URL with and without “:8123”
First things first: I believe this discussion thread is about Tailscale Funnel. However from your setup, you are not using Funnel, but Serve.
Serve working. Just note that whatever the Funnel setup guide you have followed previously likely have introduced conflicts somewhere. Also, if any forum MOD seeing this, maybe we could move a couple of posts since yesterday into a different thread… since we are going to do Serve.
= = A = =
Based on this part of your screenshots:
Tailscale Serve herehttp://192.168.0.251:8123= = B = =
Now, based on what we have so far, we want to run a series of tests, to confirm where we stand.
http://homeassistant.local:8123 should workhttp://homeassistant.local would not workhttps://homeassistant.XYZ.ts.net would not workhttp://192.168.0.251:8123 should workhttp://100.xxx.yyy.zzz:8123 (using Tailscale IP of your HA server) would not workhttps://homeassistant.XYZ.ts.net & http://100.xxx.yyy.zzz:8123= = C = =
(I run out of juice and have to sign off, but let me know the test results above)
If everything going as expected, we will then have a game plan to setup your HA Companion App
If testing is not behaving as expected, then something else is going on, & and we need to first address those.
Let me know.