Home Assistant Cloud vs Tailscale vs Cloudflare Tunnel

If you run a local-first smart home with Home Assistant at the core, one early decision is how to reach it when you’re away from home. The three common approaches are Home Assistant Cloud (Nabu Casa), Tailscale, and Cloudflare Tunnel. They solve the same problem in very different ways, and the right pick depends on whether you value simplicity, privacy, or control.

A note up front: none of these is strictly “more secure” by default. What matters is who can reach the login page and how well it’s protected. Let’s break down the real tradeoffs.

Home Assistant Cloud (Nabu Casa): the easy, supported option

Home Assistant Cloud is the paid subscription service run by Nabu Casa, the company behind Home Assistant. It’s the most straightforward way to get remote access, and your subscription directly funds Home Assistant development.

What it does

• Remote access to your instance from anywhere, with no port forwarding and no exposing your IP. Your Home Assistant stays on your network; Nabu Casa relays the encrypted connection.
• Alexa and Google Assistant integration with almost no configuration.
• Cloud-based text-to-speech / speech-to-text for Assist.
• Works on top of any install type, including a plain Container install.

The catch

• It’s a paid subscription (a flat monthly fee, no free tier for remote access). There’s a free trial, but ongoing use is paid.
• Your remote traffic is relayed through Nabu Casa’s infrastructure. It’s encrypted in transit and Nabu Casa’s privacy stance is good, but if your priority is that nothing leaves your network through a third party, the next two options keep more under your control.

Note: Home Assistant itself does the device automation locally. The “cloud” here is just the remote-access and voice-assistant relay, not where your home runs.

Tailscale: a private mesh VPN

Tailscale builds a private, encrypted (WireGuard-based) network between your own devices. Instead of publishing Home Assistant to the open internet, you join your phone and your Home Assistant box to the same “tailnet” and reach it over a private address.

Strengths

• Nothing is exposed to the public internet. Only devices you’ve added to your tailnet can connect, which is a big security win.
• Works behind CGNAT with no public or static IP. Tailscale traverses any level of NAT using outbound connections, so it works even when your ISP never gives you a reachable public address — a common situation on mobile/4G/5G home internet and many fiber plans.
• Free for personal use — the free tier covers up to 6 users and unlimited devices, which is plenty for a household.
• There’s an official Home Assistant Tailscale add-on (for HAOS/Supervised installs), or you can run the Tailscale client on the host for a Container install.

Tradeoffs

• Every device that needs access must have Tailscale installed and be logged in. That’s fine for your phone and laptop, but it means you can’t hand a plain URL to a guest or a service that isn’t on your tailnet.
• Sharing Alexa/Google requires extra work, since those clouds aren’t on your private network. (This is where Home Assistant Cloud is simpler.)

Cloudflare Tunnel: a public hostname without open ports

Cloudflare Tunnel uses a lightweight daemon called cloudflared that makes an outbound-only connection from your network to Cloudflare. You get a public hostname (e.g. ha.yourdomain.com) that Cloudflare routes back through the tunnel — with no port forwarding and no public IP required.

Strengths

• No open ports, no public IP needed. Like Tailscale, the connection is outbound, so it works behind CGNAT.
• A real public URL, which is handy for webhooks, integrations, or giving someone access without installing anything.
• You can layer Cloudflare Access (Zero Trust) in front of it to require authentication before anyone reaches the login page.
• A community cloudflared add-on makes setup on HAOS/Supervised relatively painless; you need your own domain on Cloudflare.

Tradeoffs

• More moving parts: a domain, a Cloudflare account, DNS, and tunnel config. It’s the most involved of the three.
• Mind Cloudflare’s terms. The free plan is intended for serving web content; proxying large volumes of non-HTML media (e.g. continuous video streams) can run afoul of the Self-Serve Subscription Agreement. For a normal Home Assistant dashboard this is rarely an issue, but it’s worth knowing.
• A public hostname means bots will find it. Always put authentication in front (Cloudflare Access, or at minimum Home Assistant’s own login plus 2FA).

Related products

Local-first picks from our catalog that fit this topic:

• Amcrest SmartHome AD-110 Video Doorbell - doorbell
• Athom Smart Plug V2 (ESPHome) - plug
• Hisense Window/Portable AC (Matter) - appliance

Quick verdict

• Home Assistant Cloud — easiest, supports the project, best for hassle-free Alexa/Google. Paid, and traffic is relayed by Nabu Casa.
• Tailscale — best privacy-to-effort ratio. Nothing public, free for a household, works behind CGNAT. Downside: every client needs the app.
• Cloudflare Tunnel — best when you need a public URL (webhooks, guest access). Most setup, and you must secure it yourself.

Bottom line: If you want zero fuss and don’t mind paying, use Home Assistant Cloud. If you want maximum privacy for free, use Tailscale. If you need a real public hostname, use Cloudflare Tunnel — and put authentication in front of it.