Web UI/API unreachable from time to time

Setup: Home Assistant Core 2026.9.1 (Docker, Package home-assistant · GitHub, aarch64), accessed via local IP 192.168.200.228:8123 (dedicated “IoT” VLAN), no reverse proxy in the path.

Symptom: Web UI/API has become unreachable from multiple LAN clients repeatedly over several days (browser hangs/times out). Happens multiple times a day, no obvious pattern.

What I verified:

Docker container stays running the whole time (State: running, no crash, no OOM kill, RestartCount: 0).
HA’s log keeps writing normally throughout (e.g. periodic integration callbacks every 20s) — the Python process is alive and the event loop is ticking.
Client → host: ICMP ping to the HA IP works fine (1–3ms).
Client → port 8123: TCP connection consistently times out (Connection timed out, not “refused”) — reproducible across 5 consecutive attempts, also with nc -zv.
No firewall/ACL rule specifically blocking port 8123.
A previously-known bug (our own MCP connector flooding HA with malformed server/discover requests) was not active at the time — that traffic had been quiet for ~2h.

Interpretation: Looks like a hung/overloaded aiohttp HTTP frontend in HA Core — the TCP handshake fails (SYN gets no reply) even though the host answers ICMP and the rest of the process (timer callbacks) keeps running fine. Not a container crash, not a network block.

Workaround so far: wait for a couple of minutes or manually restart container reliably brings the UI back

Question: What in HA Core’s HTTP frontend/aiohttp stack could cause the accept queue to “clog” (new TCP connections hang) while the rest of the event loop (timers, integrations) keeps running normally? Any known causes (stuck WebSocket/long-poll connections, file-descriptor limits, a specific integration) or diagnostic tools for this (e.g. py-spy, thread dump via the HA debugger)?

Hello Andreas,

Welcome to the Home Assistant Forum!

If you have some hard data and examples, maybe put in an issue.

Otherwise the common saying for stuff similar to this here is

“It’s always DNS…”

I think I found the issue:

UniFi CyberSecure IPS/IDS was actively blocking the traffic – Home Assistant’s frontend/API regularly uses HTTP DELETE requests, which the signature misinterprets as an attack. Confirmed via UniFi flow logs (100% of flows to the HA IP marked as “blocked”) and parallel packet captures on both client and host.

Fix: In the UniFi Network App → CyberSecure → Detection Exclusion, add the IP of the HA instance (Type: IP Address, Direction: Both) – this keeps IPS/IDS active for the rest of the network while excluding only traffic to/from HA from analysis.

Great, many thanks.

OK, I’ll amend that. It’s always DNS UNLESS you are using unify, then it’s their fault.