Which method to choose
| Method | Router ports | Effort | Good for |
|---|---|---|---|
| Cloudflare Tunnel | none | low | No public IP or the ISP uses CGNAT. You need your own domain on Cloudflare. |
| nginx / Caddy / NPM | 80, 443 | medium | You have a public IP and already run a proxy for other services. |
| Port forwarding | 443 | low | Quick, but the login page is open to the whole internet. |
| WireGuard | 1 UDP | medium | Safest: Home Assistant is not visible from the internet. No use for voice assistants. |
| Nabu Casa | none | minimal | Paid, but no setup, and it funds Home Assistant development. |
Error 400: Bad Request behind a proxy
The most common problem: the proxy works but Home Assistant answers 400, and the log says “A request from a reverse proxy was received… not set-up for reverse proxies”. By default Home Assistant does not trust proxies. Add use_x_forwarded_for: true and the proxy’s address to trusted_proxies: the generator above does it for each method. The second common one is a proxy without WebSocket support: the page loads and immediately says “Connection lost”.
FAQ
How do I know if I have a public IP
Compare the address on What is my IP with the WAN address in the router. If the router shows 100.64.0.0/10, 10.x or 192.168.x, you are behind the ISP’s NAT: port forwarding will not work, use Cloudflare Tunnel or WireGuard through a VPS.
Check that a port is open from outside
After setup open the port checker with your domain: 443 should be open, and 8123 closed if you use a proxy.
The companion app does not switch between home and away
Set the internal and external URL (the homeassistant: block above) and add your home Wi-Fi network in the app’s server settings. The app needs location access for this.