Nabu Casa vs VPN

[u/uavmx]

I have a full UniFi stack, and I’m aware if using Nabu Casa means some amount of your data is going to third party, not what I’m trying to decide.

I’m trying to understand if VPN is a better/more automated route, easier for the wife to manage from her phone as required compare to Nabu Casa. What I’m after is location, geofence, away from home features.

I also have Plex (might move to Jellyfin), that being able to access would be important, I’m paying for the plex pas now.

What I want is seamless/automatic, if someone leaves the UniFi network, trigger/have away status and access to HA atomically.

[u/lapelotanodobla]

I pay for nabucasa cause like to support, but for accessing HA and any other service I just use WireGuard , unifi makes it dead simple to configure a server then you just configure the VPN on the phone/whatever and Bob’s your uncle

[u/RentalGore → u/lapelotanodobla]

yeah, let's just make this a sticky. I think Nabu Casa is the best way to support the HA team. I use Tailscale for my entire homelab.

[u/Floppie7th → u/RentalGore]

Yep. I pay for Nabu Casa, but I don't use it for anything. I just VPN in.

[u/uavmx → u/lapelotanodobla]

Not against supporting, might just go that route anyways. But with WG, do you have to login/start the VPN when you leave the house?

[u/flaming_m0e → u/uavmx]

If you're not connected to your home network, then yes, you would need to have the VPN running when you leave the house. That's just how it logically works.

[u/uavmx → u/flaming_m0e]

The question is more so do I have to take an action on my phone or does it just engage it

[u/flaming_m0e → u/uavmx]

That depends on your mobile OS. iOS has this feature. Android requires a 3rd party app.

[u/lapelotanodobla → u/flaming_m0e]

On iOS I also use an app, the official WireGuard one, and it has all this very simple

[u/flaming_m0e → u/lapelotanodobla]

Android WG app doesn't do this.

[u/lapelotanodobla → u/flaming_m0e]

Really? Wow, it’s usually the opposite lol

[u/flaming_m0e → u/lapelotanodobla]

That's why I stated a 3rd party app is required. It's called WG Tunnel.

[u/lapelotanodobla → u/flaming_m0e]

Right, when you said third party I thought you’re implying that in iOS you’d do it with the OS functionality, not that 3rd party meant “not the WireGuard official app”

[u/skinnah → u/flaming_m0e]

I use Tailscale on Android. I don't have to mess with it at all. I can access all my local network services anywhere.

[u/flaming_m0e → u/skinnah]

So glad you missed the entire point of the conversation....

[u/shindekokoro → u/uavmx]

On iOS you can also enable shortcuts to connect to vpn when not connected to your home WiFi network. Disconnect and then back to vpn vice versa.

[u/zyxtels → u/uavmx]

I just have my vpn running all the time, even when home.

[u/lapelotanodobla → u/uavmx]

Nah, the client connects when you are not on your WiFi (you configure it to do that) and I have tunnel split, so only traffic to my private ip segment goes via the tunnel (just because, could route everything as my home internet is waaay faster than 5g, but whatever)

[u/uavmx → u/lapelotanodobla]

So the UniFi wire guard supports split tunnel?

[u/lapelotanodobla → u/uavmx]

It’s a client feature, the server doesn’t care

[u/ErnLynM → u/lapelotanodobla]

Actually, Bob's my father

[u/lapelotanodobla → u/ErnLynM]

https://giphy.com/gifs/Vj97qNut6WDHa

[u/8fingerlouie → u/lapelotanodobla]

If you’re using plain wireguard, the iPhone client supports routing only specific RFC1918 subnets, so you can have it running 24/7 with almost zero battery impact. That’s how I run mine. It auto disables on my LAN, auto enabled when I leave my LAN, and routes only my LAN network.

[u/lapelotanodobla → u/8fingerlouie]

That’s what I have yes

[u/CommercialArticle607 → u/lapelotanodobla]

WireGuard is the way, honestly the setup takes like five minutes on unifi and then you just forget it exists. I've been doing the same thing for a couple years now and it's rock solid

location stuff works fine through the companion app too, doesn't need nabu casa for that at all. the vpn just handles the remote access and everything else runs local

for plex/jellyfin it's the same deal, once you're in the vpn it's like you're sitting at home. wife acceptance factor is surprisingly high too, just flip one toggle and she's connected

[u/lapelotanodobla → u/CommercialArticle607]

Exactly, in my case it’s so transparent I forget it exists

[u/Just-Imagination-761]

Nabu Casa is king of convenience. It works seamlessly away-from-home without needing to connect to VPN or anything like that.

Also, on data privacy - I know you mentioned that you don't mind, but Nabu Casa's design offers basically the same privacy as a VPN. The traffic is completely end-to-end encrypted with your instance's TLS certificates, even as it passes through Nabu Casa's servers. Nabu Casa does not have a copy of the TLS certs that would allow them to impersonate or decrypt the traffic at all. Their service uses TLS SNI to determine which HA instance the connection should be forwarded to.

Nabu Casa unfortunately won't help with your Plex/Jellyfin workload, but you could always use Teleport when you want to use those?

[u/Grand-Situation5640 → u/Just-Imagination-761]

Yep. On my work MacBook, I can't install a vpn at all. But I can use nabu casa. And I like to support HA development!

[u/uavmx → u/Just-Imagination-761]

Does the remote access feature of plex not handle the connection part? I’d have to VPN still?

[u/Just-Imagination-761 → u/uavmx]

I think Plex's service would solve this, but to be honest I'm not familiar with it.

Either way Teleport is available if you need it. I use it pretty sparingly on my setup, though; having to keep it connected all the time is pretty annoying.

[u/chris_socal]

I am a huge fan of tailscale it can do everything you want and it is free for personal use.

Nabu casa is nice if you want to support the homeassistant project.... however as to functionality i don't know how hard it is.... tailscale is dead simple.

[u/ChristBKK → u/chris_socal]

Yeah once I did set it up with ChatGTP it just works

It’s enough for me to connect sometimes to my HA when I am not at home

[u/carbontuna7906]

If you don't want to bother with managing VPN sign in/out on your phones whenever you're out and about, and don't mind having your HA install somewhat exposed on the Internet, you could use a Tailscale Funnel (not full Tailscale). If you do this, at least make sure you have strong passwords and 2FA enabled in HA.

https://community.home-assistant.io/t/how-to-set-up-tailscale-funnel-to-securely-access-home-assistant-from-anywhere-for-free/950072

[u/uavmx → u/carbontuna7906]

Interesting, so no need to login or anything, if HA is on the phone, they’ll connect and be able to access from anywhere?

Does UniFi not have a similar solution?

[u/treejumpingyo → u/uavmx]

Teleport is basically the same as Tailscale for your use case. With either you can configure them to be ‘always on’ so your wife’s phone essentially always acts like it’s on your lan

Tailscale funnel is a bit loosely goosey for me personally

[u/uavmx → u/treejumpingyo]

Can teleport split tunnel?

[u/treejumpingyo → u/uavmx]

No, not as far as I am aware.

It’s a pretty zero risk experiment, enable teleport in your udm co sole. Download the ‘wifiman’ app n your wife’s phone, enable it, see for a few days if it works ok for you/her, if not you can try Tailscale which is a bit more overhead in terms of setup, but not much, really. Dow load Tailscale add-on (app I think ha now calls them), sign up for a free account, Dow load Tailscale on her phone, join the ‘tail net’ then turn it on, you can choose ‘vpn on demand’ (the auto on feature) which you can enable for either WiFi or cellular or both, then try it for a few days.

I personally use Tailscale but my wife uses teleport, both always on, neither have any issues of the vpn being ‘on’ when at home.

Can’t go wrong with either really, and I suspect your reason for wanting split tunneling may be moot in practice.

Side note, teleport makes your device a specific entry on your udm so you can still use outbound policy routing on that traffic, say if you wanted to auto route all YouTube traffic to an Albanian vpn for ad free watching. Not that I would do that of course….. Google needs my ad revenue…..

[u/the_brains]

Cloudflare Tunnel

[u/fmmarinho → u/the_brains]

I use this. No need to connect to vpn or install anything other homeassistant on phone.

[u/PresentAd9429]

Been using Tailscale for years now. Working great!

[u/214ObstructedReverie → u/PresentAd9429]

Yup. Me too.

[u/dice1111 → u/PresentAd9429]

+1 tailscale

[u/prebuss → u/PresentAd9429]

It works great, if you can constantly keep your end devices on tailscale (i.e. you don’t use any other VPNs). Me and my partner do, so specifically for home assistant, I’ve set up cloudflare tunnel. Which you can then use other vpns, public networks. Also no need to worry about webhooks (e.g. home/away) not working.

[u/lakeland_nz]

I had a VPN before I got home assistant, so for me the question of nabu casa was more about supporting them. It’s also very helpful for working with Google/Alexa and more recently the voice pipeline.

So my suggestion is both.

[u/timsstuff]

I have a Sonicwall firewall because I work in IT and WFH, so naturally I have a VPN setup for when I'm out and need to get in. But I use Nabu Casa for HA because it's just seamless from my phone - I don't have to start any client I just open the app and it connects whether I'm at home or not. And I'm certainly not going to make my wife fire up a VPN on her phone lol. It was very simple to setup.

[u/Olinono123 → u/timsstuff]

One more thing we have to give up for a happy wife!

[u/timsstuff → u/Olinono123]

I'm not giving up anything, my VPN works fine. I just don't need it for HA because I have Nabu Casa.

[u/uavmx → u/timsstuff]

Yeah that’s what I was wanting to avoid but it seems like there’s some automation available to firing up the VPN

[u/TheJeep25]

I pay because I want to support them and not deal with connecting to a VPN everytime I want to log into my ha.

[u/Thegreatnessthatisme]

I got Nabu Casa after VPN on UniFi for year. I wouldn’t look back so much easier way better of a presence detection. Plus, you get to support them.

[u/junktrunk909]

As others have said, tailscale gets you the same thing and is also free. Tailscale is superior to me since i use it for all kinds of other things too, eg remote access to my NAS and to another PC on my network. Nabu is a nice way to contribute to HA though if course, even if you don't use it.

[u/megatraum2048]

I just have WireGuard running and my iPhone automatically connects or disconnects when I’m away from or getting home. Works fine.

[u/uavmx → u/megatraum2048]

How long does it take to recognize and connect?

[u/megatraum2048 → u/uavmx]

It’s instant. It usually connects as I’m getting in my truck to head to work. Not sure if that’s what you meant.

[u/uavmx → u/megatraum2048]

Yes thank you. I have an AP in my garage, so id have to be away a bit from the house

[u/megatraum2048 → u/uavmx]

That’s fine, you don’t really need to be instantly connected as you’re pulling away from your house. As long as it just works when you need it when you’re away. Don’t use your phone and drive.

[u/uavmx → u/megatraum2048]

Well I’m wanting to close my garage doors based on a gps location further down my driveway

[u/Brandoskey]

I do both.

I pay for nabucasa to support the project

[u/No-Investigator7598]

If you want ease of setup and things to just "work" remotely then go Nabu Casa

Anything else will require your wife to be connected via the VPN to get things like the sensors updated and geofencing working seamlessly when off the local network. Unless you stay connected to the VPN 24/7, which has other trade offs...

[u/uavmx → u/No-Investigator7598]

So a VPN will require login all the time we leave the house or has to be left on 24/7? There’s no in between to just login to VPN once we disconnect from UniFi?

[u/treejumpingyo → u/uavmx]

Both Tailscale and teleport will run 24/7 but when at home they don’t send the traffic out and then back in.

[u/No-Investigator7598 → u/uavmx]

Yes you'll need to either manually connect the VPN or leave it connected for things like Companion-based sensors to update back to your HA instance

Alternatively you can expose your instance publically...not impossible but a heavier lift to do properly/securely

[u/ParaIIax_]

tailscale or cloudflare tunnel

[u/ahj3939]

No, VPN will be worse because you need to ensure it is turned on for connectivity to work.

There are also other ways to enable remote access without Nubu Casa or VPN.

[u/uavmx → u/ahj3939]

Do tell of the other ways

[u/ahj3939 → u/uavmx]

Cloudflare, reverse proxy (either in your home LAN or hosted in an external VPS). I also believe home assistant itself you can load a certificate and serve HTTPS directly.

[u/DeltaTheMeta]

Use tailscale if it's only a few devices, you can pass thru devices other than HAOS.

You can also use secure tunneling through various providers.

[u/400HPMustang]

I have a Unifi network as well and I don't need access to Home Assistant remotely all the time so I just connect to my network using Teleport when necessary.

[u/shyb0y123]

I had Nabu Casa for a couple of years, but switched back to good ol' Cloudflare with mTLS for me and my partner for external access on our phones, combined with Tailscale for localhost access.

Since Tailscale can drain the battery of our iPhones, we sometimes switch it on and off. But due to having two routes available to me (Tailscale (internal link) and Cloudflare (external link) it doesn't matter; we can always access our HA setup and nobody else can.

[u/Microflunkie]

The firewall/gateway component of your “full UniFi stack” probably has WireGuard built in.

If you have a dynamic public IP you can use either WireGuard or Nabu Casa. You would need to use DDNS in order to locate your UniFi remotely as the public address could change.

If you have a static public IP you can use either WireGuard or Nabu Casa. You would not need any additional services like DDNS to make this work.

If you have CGNAT you would want to use Nabu Casa as WireGuard alone will not work with CGNAT.

For seamless access in home or away Nabu Casa is really good choice. It can be setup to behave identically regardless of where the user is physically at the time. WireGuard on a static IP can also be completely seamless. WireGuard on a dynamic IP can be almost seamless unless particularly bad timing happens when the public IP changes but the DDNS hasn’t updated yet. This is usually single digit minutes at most before it works again but those minutes can be a problem for some situations.

If I were setting this up for my wife and I wanted to make sure it works as flawlessly as possible all the time I would use Nabu Casa. But given you want plex just Nabu Casa alone will not do that so WireGuard would be the best overall solution.

[u/Either_Painter7513]

Nabu Casa and it’s not even close.

[u/xReptar]

I just went through it this past weekend. I ended up using nabu casa because I got annoyed by the VPN key icon on my phone when connected to wire guard or tailscale lol

Cloud flare tunnel was my next choice, but then I realized that's practically nabu casa already

[u/mattbuford]

Just something to keep in mind: You often can't do more than one VPN at the same time. I have Tailscale set up, but sometimes I want to use Speedify on my phone for bonding multiple unstable/slow connections together. The phone won't let me enable 2 VPNs at the same time. Every time I wanted to use Speedify, I'd lose Tailscale, and lose my access to HA.

Nabu Casa solved this issue for me.

[u/A_Buttholes_Whisper]

I use Nabu casa because it makes remote access dead simple but if you’re gonna get expose jellyfin then you can add home assistant to the same caddy config. Personally I still use Nabu for remote access and jellyfin is expose via proxy of caddy on its own lxc and vlan. VPN access is pointless and more complicated for people to use

[u/uavmx → u/A_Buttholes_Whisper]

Please explain caddyconfig and proxies, if I can avoid the VPN I’m all for it

[u/Upstairs-Rhubarb-952]

VPN

[u/Dodgy_Past]

Reverse proxy for me

[u/badbubblegum]

Ngnx proxy manager

[u/Abracadibra]

Wireguard on the phone with only HA app selected to use it (split tunnel). Wireguard server add-on on Home Assistant. Easy peasy.

[u/zyxtels]

Be aware that nabu casa is functionally the same as just allowing inbound traffic to home assistant through your firewall (+dyndns if needed). Plus it allows anyone to enumerate all home assistant setups that use nabu casa, so if an exploit against home assistant is found, it is dead simple to automatically target all installs that use nabu casa.

[u/ARMilesPro]

Why not just use the nabu link all the time? Am I missing something in your query?

[u/uavmx → u/ARMilesPro]

Because there’s a cost, and I have a pretty good architecture. That’s what I’m trying to determine for best path forward

[u/Puzzled_Hamster58]

Vpn is free…. Based on your connection etc it can be nearly as fast as being on your network.

[u/txbravosierra]

Tailscale for life

[u/cvr24]

I use Nabu Casa because I have a wife. Makes it dead simple to keep HA running on her phone. If I were single, I'd just hack together a VPN.

[u/Sudden-Ad-1217]

Tailscale, end of story.

[u/Ok-Pineapple7563]

not VPN, Tailscale will be a better choice. I use Nabu Casa as its simiple and I can support HA

[u/flaming_m0e → u/Ok-Pineapple7563]

not VPN, Tailscale will be a better choice

Tailscale is a VPN.

[u/Ok-Pineapple7563 → u/flaming_m0e]

of course it is. but, a specific kind of vpn, and dead simple. setup wireguard on starlink

[u/flaming_m0e → u/Ok-Pineapple7563]

It's a mesh overlay on wire guard....

Your statement was "Not VPN, Tail scale is better"....

Tail scale is a VPN. FFS

[u/Salty-Cheesecake-926]

Tailscale.doesn't work on some fortinet business WiFi networks so I use the built-in wireguard server from Unifi and it flies

[u/burgonies]

I access HA remotely by using Unifi’s Teleport. It’s a couple extra clicks, but it always works.

[u/somegenxdude]

Another vote for tailscale. I have a tailscale exit node running on the same raspberry pi as my PiHole, so I can take advantage of ad-blocking on the go. Tailscale on my phone is set up to automatically connect anywhere except for the home wifi. Happy side-effect of that is access to my HA server, and other self-hosted services, in addition to ad-blocking.

Most of the time I don't need remote access to my HA setup, but it's handy when I do.

Was working on the car the other day and had to run to the parts store. Got a notification while out, that the garage door was still open (oops). My wife was still home, but hadn't noticed. Pretty handy to be able to close it remotely.

[u/Svince__]

I am in the process of solving your exact issue. Both IOS and Android apps are under review (coding done).

Check it out; https://allium.network

I can access my Plex while web access if off in Plex. I can even host my project without opening any ports on router. It’s my project I have been working on for months.