--- title: "Remote Access" description: "Reach your Dash from outside your home with a VPN (WireGuard, Tailscale) or your own address (reverse proxy, Cloudflare Tunnel)." canonical: https://glasshome.app/docs/dash/remote-access section: "Dashboards" updated: 2026-10-08 --- # Remote Access Dash runs on your hardware and is not published to the internet. To reach it from outside, you pick one of two shapes: 1. **Join your home network** with a VPN. Your device gets a home address, so Dash looks exactly like it does on the couch. 2. **Publish one address** through a reverse proxy or a tunnel you run yourself, and tell Dash to trust it. Both keep GlassHome out of the path. Nothing here is a GlassHome service. ## Pick one | Way | You open | Dash setup | Plan | | ------------------------------- | --------------------------- | --------------- | ---- | | WireGuard | your LAN address | nothing | Free | | Tailscale, subnet routes | your LAN address | nothing | Free | | Tailscale, machine name | a `.ts.net` address | add the address | Pro | | Reverse proxy at home | your domain, resolving home | add the address | Free | | Cloudflare Tunnel, your account | your domain, public | add the address | Pro | Rule of thumb: an address that lands on a home IP (`192.168.x.x`, `10.x.x.x`) is free. A public address is remote access and needs [Pro](/docs/hub/pro). ## Option 1: VPN Your phone joins the home network. The address never changes, so there is nothing to configure in Dash. ### WireGuard Classic VPN. Fast, tiny, and nobody but you is involved. Costs you one open UDP port. 1. Install the **WireGuard** add-on (Home Assistant Community Add-ons), or run WireGuard on your router. 2. Forward **UDP 51820** on your router to the machine running the add-on. UDP, not TCP. 3. In the add-on config, set `host` to a public address for your home (a DuckDNS name works), then add one peer per device and name it. 4. Start the add-on. It writes a config and a QR code per peer; scan it in the WireGuard app. 5. Turn the VPN on, then open `http://:3123`. Dash needs nothing: you arrive on a home IP, which is always trusted. ### Tailscale No port forwarding, no router work. Runs over WireGuard, coordinated by Tailscale. 1. Install the **Tailscale** add-on (or install Tailscale on the machine running Dash, if it is not the Home Assistant box). 2. Start it, open the login URL from the add-on log, and approve the machine in your tailnet. 3. Install Tailscale on your phone and sign in to the same tailnet. 4. Choose how you reach Dash: - **Subnet routes (free).** Set `advertise_routes: local_subnets` in the add-on, approve the route in the Tailscale admin console, and enable subnet routes on your phone. You then open the normal `http://192.168.1.100:3123`, and Dash needs nothing. - **Machine name (Pro).** Open `http://host.tailnet.ts.net:3123` and add that address in Dash. Tailscale addresses (`100.64.0.0/10`, `*.ts.net`) are not home addresses, so Dash counts them as remote access. ## Option 2: Your own address You run the entry point, you own the domain, and only Dash sits behind it. ### Cloudflare Tunnel on your own account No open ports: `cloudflared` dials out to Cloudflare and traffic comes back down that connection. 1. Have a domain on Cloudflare, and a Cloudflare account. 2. Install a `cloudflared` add-on (for example the community **Cloudflared** add-on) or run the `cloudflared` container next to Dash. 3. Point a hostname at Dash. In the add-on that is an `additional_hosts` entry: ```yaml additional_hosts: - hostname: dash.example.com service: http://192.168.1.100:3123 ``` 4. Start it and follow the authorization link once, so the tunnel can create the DNS record on your domain. 5. In Dash, open **Settings → Remote access → Add address** and enter `https://dash.example.com`. Cloudflare terminates HTTPS at its edge here, so Cloudflare can see this traffic. It is your account and your zone, and GlassHome is not involved. ### Reverse proxy If you already run Caddy, nginx, or Traefik, point a hostname at port `3123`. Caddy, which handles certificates and WebSockets on its own: ``` dash.example.com { reverse_proxy 192.168.1.100:3123 } ``` On nginx or Traefik, make sure the route forwards **WebSocket upgrades** (`Upgrade` and `Connection` headers). The dashboard is live over a WebSocket; without it the page loads and then stays empty. A proxy at home is only reachable from home unless you also open a port or combine it with a VPN. Its value is the tidy HTTPS address, and it is free as long as the hostname resolves to a home IP. ## What Dash needs, whatever you pick - **Expose Dash only, port `3123`.** Never publish Home Assistant. Dash talks to HA locally and forwards live state, camera images, and media on its own address. - **Declare the address.** **Settings → Remote access → Add address**, household admins only. Without it, sign-in is refused from that address. Local addresses are trusted automatically. - **The address must resolve.** A domain that does not exist yet fails the check. `localhost` and `127.0.0.1` are rejected on purpose. - **Pass `X-Forwarded-Proto: https`** if your proxy terminates HTTPS, so Dash builds its links with the scheme your browser used. - **Name your proxy.** Set `TRUSTED_PROXIES` to the address your proxy connects from (for example `192.168.1.50/32`), so Dash tells visitors apart. The Home Assistant addon needs nothing. - **Set it up at home first.** Go through the welcome screen on the local address; add the remote one after. > **Signing in while away:** Use your **Hub account**, **Code from a phone** (a code you approve from a device already signed in), or **Name and password** if someone in the home gave you one. Signing in with Home Assistant is a home-network flow: it redirects to your HA login page, which is not reachable from outside. ## What works while you are away Remote sessions route everything through your Dash at home, so the dashboard behaves the same as on your couch: live entity updates, controls, and media. Camera snapshots and album art work remotely too; Dash forwards them from Home Assistant itself, so no extra camera configuration is needed. ## Troubleshooting See [Troubleshooting](/docs/dash/troubleshooting#remote) for remote-access issues. ## Related docs - [How GlassHome connects](/docs/dash/how-glasshome-connects): why Dash wants your local Home Assistant address even when remote access is set up - [Connecting to Home Assistant](/docs/dash/connecting): local pairing comes first - [Concepts](/docs/dash/concepts): how Dash, HA, and Hub relate - [FAQ](/docs/dash/faq): privacy and account questions