MQTT from outside network (e.g. Cloudflare tunnel or NabuCasa, WireGuard)

, ,
1

Hi,
I am getting more and more frustrated with this topic and would like to hear other experiences, ideas, inputs.

I have some Shelly H&T sensors in my parent’s house that I would like to monitor in my HA. They can either push data via MQTT or Webhook (but only http as it seems).
Had some ideas and tried them out, without success so far:

  1. Setup WireGuard VPN and connect parents’ router with my HA, so that I simply can push data via MQTT. Failed because I am not at home and can’t access my router to forward necessary ports

  2. Set up Nabucasa webhook and let the Shelly push data via that one.
    Kind of annoying, little debug possibilities, and I somehow just didn’t make it work (most likely because of the Shelly not doing https?).

  3. Use Cloudflared add-on to expose HA through a tunnel, using my domain.
    Promising so far: i can access HA interface without issues.
    So I configured an additional host that would expose my MQTT broker to mqtt.mydomain.com, which I thought would work. But it hasn’t.

Now I am wondering: anybody tried any of the above or has other ideas how I could push data from my Shellys outside home to my HA instance?

Thanks a lot!

2

What do you mean? Are you frustrated because you’re not at home?
A Wireguard or tailscale VPN seem fine for your use-case…

Another option would be to have a second MQTT broker on the Internet, that you would bridge with your internal one.
Even easier if you don’t already have a broker, ofc.

3

Thanks.
I didn’t manage to get WireGuard to work (most likely because the ports are not forwarded and I am unable to configure that atm).
Tailscale VPN I’ve tried. But the Shelly’s can’t be added to that VPN, so how would I make them push messages to my HA then? Or do I misunderstand something?

4

No, indeed, that won’t work.
You can’t do site2site with tailscale, afaik.

Looks like we can:

1 Like
5

Thanks!

I also found out that I indeed can trigger webhooks using the Cloudflare-tunnelled URL.
That buys me some time to try out the site2site network via tailscale.