A few people I know have set up a homelab recently — nothing extravagant, usually a small server running Home Assistant, wired into the lights, the thermostat, a couple of sensors. At home it’s lovely. Open the phone, tap a button, the lights come on.

But it cannot be accessed when you are not connected to your home network. Nothing loads.

Talking it through with them reminded me of going through the exact same thing myself when I first set mine up. The safe, simple ways to reach a home network from outside just don’t come up very often — it’s not something most of us are taught, and it’s easy to miss if nobody happens to mention it. So I wanted to write down the explanation I wish I’d had back then.

I already write about homelabs, so it made sense to put it here rather than explain it again the next time it comes up.

One thing worth getting straight up front, since it trips up the search results more than anything else: a reverse proxy and a VPN are two different things. They both answer “how do I reach my stuff from outside?” — but in opposite ways, and knowing which one you actually want makes the rest of this much easier to follow.

Your home network is a house

Think of your home network as a house.

Every device is a room: your server is one room, your printer is another, your TV another. Inside the house, everyone wanders around freely — your laptop can talk to your printer without asking permission from anyone. That’s why Home Assistant works instantly when you’re on your own WiFi.

Your router is the front door. It’s also the only part of the house the outside world can see. Your home has a street address — an IP address your internet provider gives you — and that address is the only thing visible from the internet.

And here’s the important bit: by default, that front door has no handle on the outside. Your router lets things out, but it won’t let anything in. That’s not a bug. It’s the single most valuable security feature you own, and it’s been quietly protecting you for years.

So the question “how do I get to my server from a café?” is really the question “how do I get in through a door with no outside handle — without also letting in everyone else?”

The old way: prop the door open

The traditional answer is port forwarding.

A “port” is just a numbered door on your router. Port forwarding is you telling the router: anyone who knocks on door number 8123, send them to the server in the cupboard. Now you type your home address into your phone, knock on door 8123, and Home Assistant answers.

It works, and it’s still one of the most common ways people set this up. There’s just a downside worth knowing about before you go this route.

flowchart TB
    you(["You, on cafe WiFi"])
    bots(["Bots scanning every<br/>address, all day, forever"])
    net(("The Internet"))
    door["Your router<br/>Door 8123 propped open"]
    ha["Home Assistant"]

    you --> net
    bots --> net
    net --> door
    door --> ha

There’s someone else in that picture, though. When a door gets propped open, it’s not propped open just for you — it’s propped open for everybody. There are automated programs that do nothing but knock on every door of every address on the internet, around the clock, looking for one that opens. They’ll usually find yours within hours.

At that point, the only thing standing between the internet and your house is a password. If the software has a flaw, or a password gets reused somewhere else, or a default password never gets changed — that’s usually how it goes wrong.

There’s a practical annoyance too: most home internet providers change your street address every so often, so the address you memorised stops working at random.

Both of the good options below exist to replace this.

The two good ideas, and why they’re not the same

flowchart TB
    subgraph A["Idea 1 — a front desk (reverse proxy)"]
        a1["Anyone on the internet<br/>can walk up to it"] --> a2["It asks which room<br/>you're here to see"] --> a3["It walks you to<br/>the right room"]
    end
    subgraph B["Idea 2 — a private hallway (VPN)"]
        b1["There is no public<br/>door at all"] --> b2["Your phone temporarily<br/>becomes part of the house"] --> b3["You walk to any room<br/>directly, like you live there"]
    end
    A ~~~ B

One of these makes your house easier to visit. The other makes your house impossible to visit unless you already live there. Most people who ask about the first one actually want the second one.

Idea 1: the front desk (a reverse proxy)

A “proxy” is a stand-in — someone who acts on your behalf. A reverse proxy is a stand-in that sits in front of your servers rather than in front of you.

Instead of a numbered door per service, you get one public entrance. Visitors arrive and say which name they’re here for — home.example.com, photos.example.com, files.example.com — and the front desk walks them to the right machine.

flowchart TB
    phone(["Your phone"])
    net(("The Internet"))
    rp["Reverse proxy<br/>one public entrance<br/>handles the padlock"]

    phone --> net --> rp

    subgraph home["Your home network"]
        ha["Home Assistant"]
        nas["File server"]
        cam["Cameras"]
    end

    rp --> ha
    rp --> nas
    rp --> cam

This is genuinely useful. You get memorable names instead of numbers. You get the little padlock — proper encryption — set up once in one place instead of on every machine. You can add a new service without touching your router again.

But notice what a front desk does not do: it doesn’t make you private. The desk is still standing on a public street. Anyone can walk up to it, including all those bots. You’ve made the entrance tidier, not hidden. You still need strong passwords on everything behind it, and now the front desk itself is a thing that can be attacked.

So a reverse proxy is a great fit for things you want to be public — a blog, a photo gallery you share with relatives. On its own, it’s usually not the right fit for the control panel of your house.

Idea 2: the private hallway (a VPN)

VPN stands for virtual private network, which is a mouthful for a simple idea: your phone temporarily becomes part of your home network, no matter where you are. You’re not visiting from outside. As far as your devices are concerned, you’re in the house.

Nothing at home is public. No doors propped open. There’s nothing for a bot to find, because there’s nothing there.

The clever part is how it gets in through a door with no outside handle — and this is the bit worth understanding, because it’s the whole trick:

flowchart TB
    phone(["Your phone<br/>with the app"])
    broker(("The service's matchmaker<br/>out on the internet"))
    conn["A small helper program<br/>on your home server"]

    phone -- "dials out" --> broker
    conn -- "dials out" --> broker
    phone -. "private tunnel<br/>nothing was opened" .-> conn

    subgraph home["Your home network"]
        ha["Home Assistant"]
        nas["File server"]
    end

    conn --> ha
    conn --> nas

Nobody knocks on your door. Instead, both sides make an outgoing call to the same meeting point, and get introduced to each other there. It’s a conference line, not a doorbell.

Outgoing calls are the one thing your router has always allowed — it’s how every app on your phone works. So you get remote access without opening anything, and your router’s protection stays exactly as it was.

This is usually what people are actually looking for when they ask how to reach their home network from outside, even if “VPN” isn’t the word that comes to mind first.

The options I’d recommend

Tailscale — the easiest thing here

Install an app on each device you own. They all quietly join one private network of your own. Each device gets a permanent name and address that works identically at home, at work, or on a plane.

flowchart TB
    subgraph tailnet["Your own private network"]
        laptop["Laptop"]
        phone["Phone"]
        server["Home server"]
        nas["NAS"]
    end
    laptop <--> server
    phone <--> nas
    laptop <--> nas
    phone <--> server

Why I’d suggest it: it is the fastest path from “nothing works” to “everything works” in this entire post. Install, sign in with an existing Google or Microsoft account, done — realistically fifteen minutes. Free for personal use. Once a device has joined, it can reach everything else on that network with no further setup, so adding a new service later needs no configuration at all.

Worth knowing: that last point cuts both ways. By default, every device on your private network can reach every other one. Perfectly fine when it’s all your own gear. Less ideal the day you want to give your neighbour access to exactly one thing.

Twingate — when you want to be precise about who gets what

Twingate starts from a different assumption, usually called zero trust: nothing gets access just because it’s nearby or already inside. You don’t join the network. You get granted one specific thing, and only that thing.

flowchart TB
    phone(["Your phone"])
    check{"Are you allowed<br/>this one thing?"}
    conn["Helper program<br/>at your home"]
    stop(["Nothing happens"])
    ha["Home Assistant, and<br/>nothing else"]

    phone --> check
    check -- "yes" --> conn
    check -- "no" --> stop
    conn --> ha

Why I’d suggest it: sharing. You can hand your brother access to Home Assistant and genuinely nothing else — not your files, not your cameras, not the router settings. You get a record of who reached what and when. The home side is one small program on a machine you already run, and you never touch your router.

Worth knowing: you list what you want reachable, so each new service is one more line to add. A bit more setup than Tailscale. Traffic takes a slightly longer path, which you’d notice copying a huge file and never notice using a web page.

Choosing between them: if it’s just you and you want it working before dinner, Tailscale. If you’re sharing with family or want tight control over each service, Twingate. I wrote a much closer comparison in Twingate vs Tailscale if you want the detail.

If your home runs UniFi: use what you already paid for

UniFi is Ubiquiti’s networking gear — a favourite in homelabs because it’s solid and the app is pleasant. If your router is one of their gateways, a VPN server is already built in. It’s a switch in the app. Turn it on, add your phone, and you can reach your whole home network from anywhere without installing a single new thing.

And there’s a genuinely delightful option on top: the travel router. It’s a small box that lives in your bag. Plug it into hotel or holiday-rental internet and it creates your own WiFi network in the room, with one encrypted tunnel running all the way back to your house.

flowchart TB
    subgraph hotel["Hotel room"]
        lap["Laptop"]
        tv["Streaming stick"]
        kid["Kid's tablet"]
        tr["UniFi travel router"]
        lap --> tr
        tv --> tr
        kid --> tr
    end

    gw["Your UniFi gateway"]
    tr -- "one tunnel home" --> gw

    subgraph h["Your home network"]
        ha["Home Assistant"]
        nas["NAS"]
    end

    gw --> ha
    gw --> nas

Why this is lovely: there’s nothing to install on anything. Every device in the room joins your familiar home WiFi name and simply behaves as if it’s sitting in your living room — including devices you can’t install VPN software on, like a streaming stick or a games console. You connect the box once; everyone else just connects to WiFi.

Worth knowing: it’s one more thing to carry and power. Everything routes through your home, so it’s limited by your home internet’s upload speed. And hotel WiFi that makes you accept terms on a web page needs you to do that once through the box.

Honourable mentions

  • WireGuard on its own — free, very fast, and the most manual. You set up and maintain everything yourself, and you still need either one open door or a rented server to meet at. Tailscale is built on top of WireGuard; it’s this, with the tedious parts handled.
  • Cloudflare Tunnel — uses the same outgoing-call trick, but the result is a public web address. Excellent for something you want the world to see. Not the right choice for a control panel unless you add their login screen in front of it.
  • Nginx Proxy Manager, Caddy, Traefik — these are the actual reverse proxies. Nginx Proxy Manager is the friendly one: a web page with boxes to fill in. Caddy is a handful of lines in a text file and handles the padlock automatically. Traefik is for people who are deep into containers.

One more thing worth mentioning: these two ideas combine well. Run a reverse proxy inside your house for nice names and padlocks, and use a VPN as the only way to reach it. You get the tidiness of the front desk with none of the public exposure. That’s the setup I’d point most people towards.

The unglamorous half: knowing your stuff is alive

Remote access is only worth having if the thing at the other end is actually running. Home servers fail quietly. A disk fills up, a program crashes at 2am, the power blinks, the internet drops. Nothing announces it. You find out at the worst possible moment — standing in an airport, trying to check whether you left the heating on.

So set up something that watches, and tells you.

There are two separate jobs here, and the second one is the one everybody forgets:

flowchart TB
    subgraph home["Your home network"]
        watcher["A watcher program<br/>checks everything<br/>every minute"]
        ha["Home Assistant"]
        nas["NAS"]
        gw["Router"]
        watcher --> ha
        watcher --> nas
        watcher --> gw
    end

    phone(["Your phone"])
    cloud["An outside service<br/>that watches the watcher"]

    watcher -- "something is down" --> phone
    watcher -- "still alive, every<br/>5 minutes" --> cloud
    cloud -- "heartbeat stopped:<br/>power or internet is out" --> phone

If the power goes out at home, your home watcher dies with it, and silence looks exactly like everything being fine. That’s why the outside piece matters.

Watchers that run at home:

  • Uptime Kuma — start here. A page full of green dots, one per thing you care about, checked every few seconds. When one goes red it messages your phone, or email, or Telegram. Free, one small program, twenty minutes to set up. If you do only one thing from this section, do this one.
  • Beszel — light and tidy, shows how busy each machine is and how full its disks are. Pairs nicely with Uptime Kuma.
  • Netdata — extremely detailed graphs of everything, with essentially no setup. More information than most people need, but it’s there when something’s behaving oddly.
  • Prometheus and Grafana — the industrial-strength option. Enormously capable, keeps years of history, and has a real learning curve. Worth it eventually, but don’t start here.
  • Scrutiny — watches hard drive health specifically. Drives usually complain for weeks before they die. This is how you hear the complaining.
  • Homepage or Glance — not monitors, but a nice start page with links and status lights for everything you run. Good for the rest of the household.

Watchers that live outside your house:

  • UptimeRobot or Better Stack — free tiers that check from the outside and tell you when your home stops answering.
  • Healthchecks.io — the heartbeat idea above. Your server says “still alive” on a schedule; if it ever stops, you get told. Nothing at home needs to be reachable from outside for this to work, which makes it a perfect fit here.
  • Your UniFi gear, if you have it — it can already email or notify you when the internet drops or a device disappears. Free, already installed, and switched off by default. Go turn it on.
  • Home Assistant itself — if that’s what you’re already running, it can check whether devices respond and push alerts to your phone. The cheapest possible start.

The rule of thumb: one watcher inside, one watcher outside, both pointed at your phone. That’s most of the value, in about an hour.

What I actually use

Twingate and UniFi.

Twingate is my day-to-day. My laptop and phone can reach exactly the services I’ve allowed and nothing more, my router has nothing open on it, and when someone in the family needs access to one thing I can grant that one thing without handing over the house.

UniFi runs the network itself, and its built-in VPN covers the times I want my whole device tunnelled home rather than access to a specific service — plus the travel router when I’m away for longer and want the whole room to feel like home. The two don’t fight: Twingate is per-person access to particular services, UniFi is whole-device access to the network.

I use Tailscale too, in a different corner — it’s what connects the two machines in my split-brain AI setup. It’s excellent. If I were starting from nothing today with no plan to share access, it’s what I’d pick for the speed alone.

If you just want a plan, do this

  1. Pick one: Tailscale or Twingate. Install the app on your phone, install the helper program on the server in the cupboard. Twenty minutes.
  2. Undo any port forwarding you set up. You don’t need those doors anymore. Close them.
  3. Install Uptime Kuma. Add Home Assistant, your router and your NAS. Point the alerts at your phone.
  4. Add a free outside checker with a heartbeat, so you hear about it when the power goes out.

Then stop. That’s a setup you can actually trust, built entirely from a couple of app installs — no networking background required.

That’s the real point, I think. The genuinely good options here have become boring to set up — an app, a sign-in, fifteen minutes. The hard part was never the technology. It was only ever knowing that this was possible, and which of the two ideas you were looking for.