<\/span><\/h3>\nWe must be clear: Home Assistant Link is a service paying<\/strong>. At home, the subscription costs \u20ac75 per year<\/strong>.<\/p>\nBut it is not just remote access. The pack also includes:<\/p>\n
\n- Off-site backups.<\/li>\n
- Voice control with Alexa and Google Home.<\/li>\n
- Voice processing, with recognition and speech synthesis.<\/li>\n
- Improved streaming for cameras and media.<\/li>\n
- Support dedicated to Link functions.<\/li>\n
- The ability to build your own private voice assistant.<\/li>\n<\/ul>\n
![\"\"](\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/11\/Capture-decran-2026-11-11-181921.png\")
<\/p>\n
Originally, I had taken him mainly for the connection with Alexa. Finally, I also use the other functions: off-site backups, backups, streaming and the practical side of secure remote access.<\/p>\n
Over time, I also see it as my contribution to the funding of Home Assistant and its independence.<\/p>\n
Nabu Casa states that the majority of its profits are donated to the foundation behind Home Assistant, the Open Home Foundation. The service is funded by subscriptions, without venture capital or advertising.<\/p>\n
It is thanks to people like us, Nabu Casa subscribers, that the team can offer a home automation experience accessible to everyone. Each Link subscription finances the Open Home Foundation, which pays full-time developers to take the Home Assistant project forward and maintain its independence. No private investment, no advertising, no data collection.<\/p>\n
So I have not only bought remote access, I also support an open source project that I trust and use on a daily basis.<\/p>\n
<\/span>\ud83d\udeab I am not exhibiting Home Assistant with port forwarding<\/span><\/h2>\n![\"\"](\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/11\/ports-300x150.png\")
<\/p>\n
On the rules of my server, no port forwarding pushes incoming requests to Home Assistant<\/strong>.<\/p>\nSo I did not open port 8123 from my box to Home Assistant. Nor have I created a NAT rule that would make my interface directly accessible from the outside.<\/p>\n
It is a voluntary choice. Opening a port to Home Assistant means exposing the Internet connection page. Even with a strong password, this increases the attack surface: robots constantly scan the exposed services and attempt automated connections.<\/p>\n
And it is not only Home Assistant that would be concerned. Poorly thought-out port forwarding can also expose part of the home network, depending on how the server, box, and firewall rules are configured.<\/p>\n
I prefer not to expose anything directly. With Home Assistant Link, my installation establishes an outgoing connection to the Nabu Casa relay. When I connect from the outside, the communication goes through this relay, rather than through a redirect rule on my box.<\/p>\n
<\/span>\ud83e\udde0 What it really changes<\/span><\/h3>\nIn practical terms, this means that:<\/p>\n
\n- I have no incoming ports redirected to Home Assistant.<\/li>\n
- I have no public IP address directly exposed by a redirect rule.<\/li>\n
- I do not have any certificates to renew manually.<\/li>\n
- I have no reverse proxy to maintain.<\/li>\n
- My Home Assistant interface is not directly visible from the Internet.<\/li>\n<\/ul>\n
<\/span>\ud83c\udf10 I dropped the reverse DNS to my fixed IP<\/span><\/h2>\nBefore choosing Home Assistant Link, I had seriously tested a solution with a Reverse DNS to my fixed IP address<\/strong>. My ISP allowed me fixed IP and reverse DNS.<\/p>\nThe idea was to have a domain name that pointed to my fixed IP and then set up a reverse proxy with HTTPS to access Home Assistant securely.<\/p>\n
This is a very valid approach, and it is often used by people who want a custom URL, such as home.mydomain.fr<\/code> for example.<\/p>\nBut, honestly, this solution didn't trust me.<\/p>\n
<\/span>\u26a0\u2718 Why I gave up this track<\/span><\/h3>\nBetween the domain name, Let\u2019s Encrypt certificate, reverse proxy, headers X-Forwarded-For<\/code>, trusted proxies and updates to follow, I didn't feel shouldered to maintain all this properly over time.<\/p>\nI am not saying that this is a bad solution. On the contrary, it can be very interesting if one is comfortable with the administration of a server, a reverse proxy and network security.<\/p>\n
But at home, I wanted a solution that I understand well, that I can maintain without stress and that does not ask me to constantly monitor an Internet exposure.<\/p>\n
I therefore preferred to abandon this track rather than keep a configuration that I would not be sufficiently familiar with.<\/p>\n
<\/span>\ud83d\udd11 The settings I keep in place<\/span><\/h2>\nEven if remote access is via Home Assistant Link, account security remains essential.<\/p>\n
Here are the rules I apply:<\/p>\n
\n- Each user has their own account, with a unique password.<\/li>\n
- I use the double authentication<\/strong> with an authentication application.<\/li>\n
- I don't share an administrator account between multiple people.<\/li>\n
- I limit the rights of users who do not need to administer Home Assistant.<\/li>\n
- I keep my installations, add-ons and integrations up to date.<\/li>\n
- I do not publish other services of my local network directly on the Internet.<\/li>\n<\/ul>\n
<\/span>\ud83e\udde9 Accounts with limited rights<\/span><\/h3>\n![\"\"](\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/11\/utilisateurs.png\")
<\/p>\n
I don't give everyone an administrator account. Each person has a dedicated account, with only the rights necessary for its use.<\/p>\n
I take this opportunity to limit rights as much as possible. There were far too many profiles in the administrators group.<\/p>\n
If someone only needs to consult a few entities, they do not need to be able to change the configuration, create automations or access system settings.<\/p>\n
This is a simple but very effective principle: not to give more rights than necessary<\/strong>. Zero trust principle.<\/p>\nWhen an account does not need to log in remotely, I check local access only.
\n![\"\"](\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/11\/Capture-decran-2026-11-11-183202.png\")
<\/p>\n
<\/span>\ud83d\udd10 Double authentication is essential<\/span><\/h3>\nDouble authentication is the setting that I consider essential. If my password were to leak or be reused elsewhere, access could not be validated without the code generated by my authentication application.<\/p>\n
![\"\"](\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/11\/Capture-decran-2026-11-11-184157.png\")
<\/p>\n
In Home Assistant, simply go to your user profile and then to the tab Security<\/strong>. In the part Multi-factor authentication modules<\/strong>, I choose Activate<\/strong> in Authentication application<\/strong>.<\/p>\n![\"\"](\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/11\/Capture-decran-2026-11-11-184319.png\")
<\/p>\n
We then scan the QR code with an application such as Microsoft Authentificator, Google Authenticator, 2FAS, ... or its password manager if it does so, and then validate with the six-digit code.<\/p>\n
This is done. The screen is not the most intuitive, but the presence of the button Disable<\/strong> confirms that the functionality is active.<\/p>\n![\"\"](\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/11\/Capture-decran-2026-11-11-184529.png\")
<\/p>\n
It is important to do this operation for each user<\/strong> with access to Home Assistant. An account without double authentication can become the weakest link in the entire installation.<\/p>\nI also recommend keeping recovery codes in a password manager or in a safe place. They are essential if you lose your phone.<\/p>\n
<\/p>\n
<\/span>\ud83c\udfaf My Feeling<\/span><\/h2>\nHonestly, I am very happy with this choice. I'll even say reassured.<\/p>\n
I did not try to make the most complex configuration possible. I have chosen the solution that seems to me the most reasonable for my use: Home Assistant Link for remote access, no port redirection to Home Assistant and enhanced account-level security<\/strong>.<\/p>\nI also agreed to set aside the reverse DNS to my fixed IP. It was not because the solution was wrong, but because I did not feel comfortable enough to administer it and maintain it calmly.<\/p>\n
For me, good security is also a solution that we understand, that we know how to maintain and that we are not afraid to look at six months later.<\/p>\n
<\/span>\ud83c\udfc1 Conclusion<\/span><\/h2>\nSecuring an externally accessible account is not just about choosing a good password.<\/p>\n
It is necessary to combine several protections: double authentication, access via a secure service or a VPN, absence of unnecessary port redirection, regular updates and principle of least privilege.<\/p>\n
In my case, Home Assistant Link ticks all these boxes. It gives me simple, encrypted, and easy-to-maintain remote access, without directly exposing my installation.<\/p>\n
And, icing on the cake, the subscription also contributes to the financing of Home Assistant and its independence. For me, it is a practical, secure choice that is consistent with my vision of home automation.<\/p>","protected":false},"excerpt":{"rendered":"
Quand on utilise Home Assistant au quotidien, l\u2019acc\u00e8s \u00e0 distance devient tr\u00e8s vite indispensable. Consulter un capteur, v\u00e9rifier qu\u2019une porte est bien ferm\u00e9e, recevoir une alerte ou piloter un \u00e9quipement depuis son t\u00e9l\u00e9phone : ce sont des usages simples, mais qui changent vraiment la mani\u00e8re d\u2019utiliser sa domotique. Mais d\u00e8s que l\u2019on parle d\u2019acc\u00e8s depuis […]<\/p>","protected":false},"author":1,"featured_media":11975,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[70,14,53,166],"tags":[],"class_list":["post-11958","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurite","category-domotique","category-home-assistant","category-retex"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/11958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/comments?post=11958"}],"version-history":[{"count":5,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/11958\/revisions"}],"predecessor-version":[{"id":11974,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/11958\/revisions\/11974"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/media\/11975"}],"wp:attachment":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/media?parent=11958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/categories?post=11958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/tags?post=11958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}