Secure Remote Access to Home Assistant with Cloudflare Zero Trust Tunnels

It can be tempting to keep Home Assistant OS (HAOS) completely isolated on your local network, especially if you want to avoid fiddling with router port forwarding or managing complex VPN solutions. However, keeping HAOS locked down like this limits some of Home Assistant's best features—such as controlling your smart home while away, receiving real-time push notifications, or watching low-latency live streams from Frigate cameras via WebRTC.

If setting up and maintaining port forwarding or a dedicated VPN feels like overkill (and it is), there is a modern, top-notch alternative: Cloudflare Zero Trust Tunnels.

To set this up, all you need is a free Cloudflare account and a custom domain (which you can register directly through Cloudflare for as little as $5/year for a .uk TLD).

Setting Up a Cloudflare Zero Trust Tunnel

From the Cloudflare dashboard, use the quick search bar in the left navigation panel (located right under your username) to search for and access Zero Trust.

In the Zero Trust dashboard, navigate to Networks → Tunnels & Mesh (or Tunnels).

Click the Create a tunnel button and select Cloudflared as your connector type.

Enter a descriptive name for your tunnel (such as home.tun or myhome.ha.tun), then click Save tunnel.

After saving, the Configure page will appear with generic OS installation instructions. What you need here is the generated access token located near the bottom under the option to Run the tunnel manually:
cloudflared tunnel run --token eyJh...
Copy this command (to extract the token string directly following --token) and keep it ready for the next step.

then click Next and Complete setup

Connecting Home Assistant to Your Cloudflare Tunnel

In Home Assistant, navigate to Settings → Apps (formerly Add-ons), search for Cloudflared, and click Install. Important: Do not start the app yet! Before running it, you must configure the access token copied from the Cloudflare dashboard.

Go to the Configuration tab. Set External Home Assistant Hostname to your desired domain (e.g., homeassistant.yourdomain.com—we will use this later in the Cloudflare Tunnels dashboard), paste your token into Cloudflare Tunnel Token, and click Save.

Home Assistant Cloudflared settings.

Return to the Info tab. Toggle on Start on boot, Watchdog, and Auto update, then click Start to manually start the Cloudflared app.

Because Home Assistant restricts reverse proxy connections by default, you must configure configuration.yaml to trust traffic coming from the Cloudflared app. Open configuration.yaml (/homeassistant/configuration.yaml) using your preferred method (Terminal, File Editor, or VS Code) and append the snippet below to the end of the file:

# cloudflared
http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.32.0/23

Save the file and restart Home Assistant (Settings → top-right three-dot menu → Restart Home Assistant). The Cloudflared app will autostart.

Publish an Application Route for Home Assistant

Return to the Cloudflare portal (Networks → Tunnels). A status of Healthy should now appear next to your tunnel. Click your tunnel name, navigate to Published application routes, and click Add a published application route.

Select a Subdomain and Domain so that the resulting Full hostname matches the exact FQDN you configured earlier in the Cloudflared app (e.g., homeassistant.yourdomain.com) and click >Save.

Cloudflare Tunnel Application Route for Home Assistant.

Set the Home Assistant Network settings (Settings → System → Network) Home Assistant URL to match https://homeassistant.yourdomain.com, while keeping your local network URL as-is.

That's it! You can now securely access your Home Assistant OS instance via web browser or via the Companion app using your custom FQDN address.

Final Words: Even if your Home Assistant FQDN isn't publicly indexed, anyone who discovers your URL can still attempt to log in. As a rule of thumb, always enable Multi-Factor Authentication (MFA/2FA) on every user account. That way, even in the event of an unfortunate leak of your URL, username, and password, no one can gain access without that second factor.