Nabu Casa vs DuckDNS: Home Assistant Remote Access
The fastest way to reach your Home Assistant dashboard from outside your home is Home Assistant Cloud (Nabu Casa): it's a paid subscription that works in a few clicks with no networking knowledge, and it directly funds the open-source project. The main free alternative is a DuckDNS domain plus a reverse proxy, which costs nothing but requires you to configure dynamic DNS, TLS certificates, and either port forwarding or a tunnel yourself. If you value your time and want zero maintenance, Nabu Casa is the pragmatic pick. If you enjoy self-hosting and want full control, DuckDNS is a capable, well-documented route.
Why remote access needs care in the first place
Home Assistant runs on your local network, so by default it's only reachable at home. To use it away from home — checking cameras, arming an alarm, getting phone notifications that link back to a working dashboard — you need a secure path from the internet to your instance.
The tempting shortcut is to forward a port on your router straight to Home Assistant. Don't. That exposes a login page to the entire internet, and Home Assistant's own guidance discourages it because a single misconfiguration or unpatched flaw becomes a doorway into your home network. Both options below exist specifically to avoid that risk: Nabu Casa by routing through an encrypted relay, DuckDNS-plus-proxy by putting a hardened, TLS-terminating layer in front of Home Assistant.
Nabu Casa (Home Assistant Cloud) in brief
Nabu Casa is the official cloud service run by Home Assistant's founders. You enable it from the Home Assistant Cloud page in Settings, sign in, and you get a stable https:// URL that works from anywhere. There is no port forwarding, no certificate to manage, and nothing exposed directly on your router — your instance makes an outbound connection to the relay instead.
Beyond remote access, the subscription unlocks the official Amazon Alexa and Google Assistant integrations (which are genuinely painful to self-host), plus Home Assistant Cloud text-to-speech used by many voice setups. Revenue funds core development, so the subscription doubles as project support.
DuckDNS + reverse proxy in brief
DuckDNS is a free dynamic DNS provider. Most home internet connections have an IP address that changes periodically; DuckDNS gives you a hostname (like yourname.duckdns.org) that automatically follows your changing IP. The official DuckDNS add-on can also request and renew a free Let's Encrypt TLS certificate so your connection is encrypted.
DuckDNS alone still leaves you deciding how traffic reaches Home Assistant. The recommended pattern is a reverse proxy — commonly the NGINX Home Assistant SSL proxy add-on — sitting in front of your instance to terminate TLS and forward requests. You then either forward a single port (443) on your router or, increasingly, use a tunnel service such as Cloudflare Tunnel to avoid opening any inbound port at all. If you're comfortable installing add-ons, this is well within reach, but it is a chain of moving parts you own.
Side-by-side comparison
| Factor | Nabu Casa (HA Cloud) | DuckDNS + reverse proxy |
|---|---|---|
| Cost | Subscription (about $6.50/month or ~$65/year at time of writing) | Free (DuckDNS and Let's Encrypt are free) |
| Setup effort | Minutes; sign in and toggle on | Moderate; add-ons, DNS token, certificate, proxy, networking |
| Port forwarding | None required | Usually port 443, unless you use a tunnel |
| TLS certificate | Handled for you | You configure auto-renewal (Let's Encrypt) |
| Alexa / Google Assistant | Included, officially supported | Not included; self-hosting these is complex |
| Ongoing maintenance | Effectively none | You own updates, renewals, and troubleshooting |
| Supports the project | Yes, directly funds development | No direct funding |
| Control & privacy | Traffic relays through Nabu Casa (encrypted end to end) | Traffic stays on infrastructure you choose |
- One toggle, works in minutes
- No router changes or certificate chores
- Unlocks Alexa and Google Assistant
- Free forever
- Full control over routing and data path
- More to learn, more to maintain
Security: both are solid when done right
Neither option is inherently "more secure" — the difference is who is responsible for keeping it that way. With Nabu Casa, encryption and the relay are maintained by the Home Assistant team, so there's little for you to get wrong. With DuckDNS, security depends on your choices: keeping the reverse proxy and certificates current, using strong passwords, and enabling multi-factor authentication.
Whichever you pick, turn on two-factor authentication in your Home Assistant user profile. And if you're exposing a login to the internet by any method, a solid backup and restore routine matters even more, so a bad update or lockout is recoverable.
What DuckDNS setup actually involves
If you lean toward the free route, here's the shape of the work so there are no surprises.
- 1Install the DuckDNS add-on, add your token, and let it request a Let’s Encrypt certificate
- 2Install a reverse proxy add-on (e.g. NGINX Home Assistant SSL proxy) pointing at your instance
- 3Open port 443 to the proxy, or use a tunnel like Cloudflare Tunnel to avoid opening any port, then confirm access and enable two-factor authentication
Which should you choose?
Match the choice to what you value most.
- Choose Nabu Casa if you want remote access working today with no networking know-how, you use or plan to use Alexa or Google Assistant, or you'd rather pay a modest fee than maintain infrastructure. It's also the right call if reliability while traveling is non-negotiable, since there's nothing on your end to expire.
- Choose DuckDNS + reverse proxy if you're comfortable with self-hosting, want to avoid a subscription, or specifically want traffic to stay on infrastructure you control. It pairs naturally with a tinkerer's setup — the same mindset that leads people to install HACS and custom components.
A reasonable middle path many users land on: start with DuckDNS to learn how remote access works, then switch to Nabu Casa once you decide your time is worth more than the monthly cost — or keep DuckDNS and simply support Home Assistant another way. Both keep your dashboard reachable; the trade-off is convenience and support versus cost and control.
Frequently asked questions
Is Nabu Casa required to use Home Assistant remotely?
No. Nabu Casa is optional and never required for core functionality. It's the easiest path and it funds development, but DuckDNS with a reverse proxy, a VPN back to your home network, or a tunnel service are all valid free or low-cost alternatives.
Can I get Alexa or Google Assistant without Nabu Casa?
Technically yes, but it's involved. Self-hosting the Alexa and Google Assistant integrations requires manual cloud configuration and public HTTPS endpoints, which is why most people who want reliable voice control simply subscribe to Nabu Casa, where it's officially supported.
Does DuckDNS work if my internet provider uses CGNAT?
Not by itself. If your provider uses carrier-grade NAT, you don't have a public IP to forward a port to, so DuckDNS-plus-port-forwarding won't reach you. A tunnel such as Cloudflare Tunnel or a service like Nabu Casa, which relies on an outbound connection, sidesteps this entirely.
Will remote access break my local automations?
No. Remote access only changes how you reach the interface from outside; your automations run locally on your instance regardless. If your internet drops, local control keeps working — you just lose the remote view until the connection returns.