Securing HA open internally and 2FA externally

Configuration
1

I’ve failed at this in the past… failed hard. Completely locked all access from any network addresses twice. Its been a while and I’d like to try again but decided to ask for help this time.

Can anyone help tell me if its possible and how to / example of configuration.yaml section.
I’ve tried to use

#  auth_providers:
#  - type: trusted_networks    
#    trusted_networks:
#      - 192.168.1.1/24
#    allow_bypass_login: true

but honestly I’m afraid to try again.

What I would like to do it have no need for a userid and password if someone is in my home network or VPN BUT require a password or even 2 factor auth if on other/unknown network. 2FA isnt a requirement for me it would just be a nice to have if its easy enough to setup and use.

I use NABU CASA for remote access and have no issues there. Love it and don’t want to change anything on my iphone for that.

2

When you added the trusted_network auth section, did you also add in the homeassistant auth provider? See the link below

*I also failed with this in the past and somehow missed the giant note.

I believe that 2FA is user based so it wouldn’t switch based on whether you are on you local network or remote.

3

Thank you very much but I’m still a little unsure.

If I follow their example:
auth_providers:
- type: trusted_networks
trusted_networks:
- 192.168.0.0/24
- fd00::/8

I should also include:
- type: homeassistant

Like this?
auth_providers:
- type: trusted_networks
- type: homeassistant
trusted_networks:
- 192.168.1.1/24
- 192.168.4.1/24

Will that allow password bypass for people in the ip ranges?
Will it also complete block all other access or just require a user name and password from outside those ranges?

4 
  auth_providers:
    - type: homeassistant
    - type: trusted_networks
      trusted_networks:
        - 192.168.1.14

Put home assistant above trusted networks. (see the above example from my config) Also pay attention to indentations. Also please format your code properly when posting, it helps those trying to help you. You need three back ticks before and after your pasted code. See the example below

1 Like
5

Below is what I’m using with DuckDNS and NGINX. It allows only my laptop’s static IP to log in locally without requiring a password or 2-factor auth code. If I log in using any other IP address, either local or remote, it prompts for username and password, followed by the 2-factor auth prompt. In your case, the - 192.168.1.1/24 entry would do the same for any IP on that local subnet. I’m not sure what IP range is used when connecting with Nabu Casa. Be sure to add the - type: homeassistant entry, as that is what allows it to default back to the default login method if anything fails.

homeassistant:
  customize: !include customize.yaml
  auth_providers:
    - type: trusted_networks
      trusted_networks:
        - 192.168.0.113
    - type: homeassistant
1 Like
6

Thank you very much and also for the posting info.

7

This is great thank you. I’m going to try tonight when I’m at home… I don’t trust myself enough to make this change while I’m not there in person. I’m also going to make sure I have remote file address to my VM as a back up.