Is this a security risk: remote access to ESPHome through port forwarding?

ESPHome
1

I’m running Home Assistant locally in my home network and I’ve installed an ESPHome device in a remote location (house from a family member at the other side of town). I would like to control the ESPHome device from my Home Assistant install.

I don’t have the option to setup a VPN to the remote location so I’ve forwarded the ports to access the ESPHome API and do OTA updates. The API is password protected and encrypted (but I have no idea how secure this encryption is) and the OTA component is password protected.

Does this leave attack vectors open to bad actors? Or can this approach be considered relatively secure?

Here is the relevant yaml config for the ESPHome device:

api:
  # Forward this TCP port to access API remotely
  port: 6053
  password: !secret api_password
  encryption:
    key: !secret api_encyption_key

ota:
  password: !secret ota_password
  # Forward this TCP port to do OTA updates remotely
  port: 8266

# Configure Wi-Fi connection
wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_pass
  # Public host/IP that this ESPHome device can be reached on
  use_address: !secret remote_dyndns_host
2

If you can then get static IP-addresses.
If not then try to lock the connections down as much as possible, either by MAC-address filtering or host/network filtering.
You know the ISPs used, so it should be possible to get their IP ranges and at least limit access from those only.

3

Thanks, I thought of that but the firewall in the router used at the remote location unfortunately doesn’t support this.

4

It’s not the devices that needs static IP-addresses, but the routers.
This is probably something you will have to get setup by your ISPs.

5

don’t have the option to setup a VPN

Just to get exposure to Wireguard, I think your case might benefit from this: WireGuard Support for ESP32 · Issue #1444 · esphome/feature-requests (github.com)

There is “a quick and ugly guide” on last comment.

I have not tested this (yet) but I think better option (replacing Oracle Cloud) would be fly.io. They are great company and they have very generous free tier and Wireguard is there by default.

2 Likes
6

IPs are already static, what I meant is that the firewall in the router doesn’t support ingress rules. So no filtering/blocking IPs per port or device.

Wow, Wireguard on an ESP: that’s really cool! And there’s even a working example to use with ESPHome already. I wonder if this will eventually be integrated into ESPHome natively and for ESP8266 too (which most Sonoff devices are based on).

7

Your routers have NAT’ing with port forwarding, but no way of filtering?
Sorry, but that sounds a bit weird, so what brand and make are your routers?

8

FRITZ!Box by AVM. It’s possible to create a list of permitted websites but as it is explained this is for egress traffic only, but maybe they also block ingress. Also, it is not clear to me if I can add IP addresses to those lists.

@savikko what free tier allowance over at fly.io are you looking at btw? I only see a shared CPU VM with 256MB RAM which is not enough to run HA. Or are you thinking of running a Wireguard-only server with them?

9

WOW!
An “apple” router - We think you are too stupid to handle a firewall, so we remove all functions to control it.

Get another router!

10

Actually, you probably don’t have to run anything there. Their free tier allowance is three of those 256M instances and that is limited by organization. Every organization has their own wireguard network.
So actually you could probably create just new organization, create there couple wireguard peers (flyctl wireguard create) and their infrastructure is then the wireguard server. Those peers who have connected to that one organization, can connect other peers within that organization.

So, one peer for ESP and another peer for your own HA instance.

No idea if that use-case is allowed by their free tier and no idea if that ESPHome thingie works as fly.io WG network is ipv6 only.

1 Like
11

I actually tried this a bit.

As long as you have ipv4 wireguard server somewhere, i think everything works flawlessly.

But ipv6 support with that is still little bit something which almost, but not quite, there.

Also, running esp-idf on windows when building esphome just does not work. Did not yet try on Linux.

12

I don’t know your setup, but if you’re running HA OS or HA Supervised you could just install the Wireguard add-on and add a peer for every ESPHome device. I haven’t tested this myself but I think that would be the easiest way to get connectivity between HA and remote ESPHome devices using Wireguard. This would require forwarding ports for the Wireguard add-on of course. If that’s a problem then using a cloud provider in between to host the Wireguard server seems like a good alternative.

The Github instructions you linked to earlier specifically use a cloud provider (Oracle) to host HA entirely in the cloud instead of locally.