CloudPub for Home Assistant: remote access without a public IP

CloudPub is a tunnelling service that gives Home Assistant remote access without a public IP address or port forwarding. In Home Assistant it installs as the CloudPub Client add-on: the client connects to the service’s servers itself, and you get an HTTPS URL like https://….cloudpub.ru that works from any network.

Updated in September 2026: new Home Assistant menu paths, free plan limits, protecting the login page, running on Home Assistant Container, publishing MQTT and other services, and a comparison with Nabu Casa, Cloudflare Tunnel, Tailscale and OpenZiti.

What CloudPub is and how it works

Normally, Home Assistant remote access requires a public IP and a port forward on the router. Many ISPs put customers behind carrier-grade NAT, which makes port forwarding impossible. CloudPub works the other way round: the client inside your home network opens an outbound connection to an external server, and that server passes requests from your phone or laptop through that tunnel.

• Home Assistant access from the internet without a public IP or router configuration;
• HTTPS with a ready-made certificate — no own domain or Let’s Encrypt needed;
• works with the Home Assistant mobile app, notifications and voice assistants that need an external URL;
• the same client can publish other local services too.

The add-on is unofficial: it is maintained by the community, not by the service developers. The source code is in the GitHub repository and updates ship regularly.

CloudPub plans: what is free

Feature	Free plan	PRO
Home Assistant web UI over HTTP/HTTPS	yes	yes
Address	cloudpub.ru subdomain	subdomain or your own domain
Traffic	250 GB per month	unlimited
TCP, UDP, MQTT, RTSP	no	yes
RDP and VNC	no	yes

For the Home Assistant web UI and app the free plan is plenty: the interface and notifications use little traffic. Cameras on a dashboard use the most. See the plans page for current prices.

Installing CloudPub Client in Home Assistant

Add-ons are available on Home Assistant OS and Supervised. On Container and Core you run the client in Docker — see below. Installation:

1. Open Settings → Apps → Install app. Newer versions call add-ons apps; in older ones the path is Settings → Add-ons → Add-on store.
2. Menu (three dots) → Repositories → add https://github.com/black-roland/hassio-addon-cloudpub.
3. Refresh the page and install CloudPub Client. The Canary version is built on your own server and is meant for testing only.

You can also open the installer through this My Home Assistant link — the repository is added automatically.

Configuring the reverse proxy in Home Assistant

By default Home Assistant rejects requests coming through a proxy and returns 400: Bad Request. Allow them once:

1. Open Settings → System → Network.
2. In HTTP server → Reverse proxy turn on Use X-Forwarded-For.
3. Add the trusted proxy 172.30.33.0/24 — the internal add-on network.
4. Save.

On a regular Home Assistant OS install you do not need to change the subnet, including in a virtual machine on Proxmox VE. If the 400 error persists, look in the Home Assistant log for Received X-Forwarded-For header from an untrusted proxy — it shows the real proxy address to add. If you also run Dataplicity, add 127.0.0.1/32 as well.

CloudPub token and publishing Home Assistant

1. Sign up in the service dashboard and copy the API key from the section about linking an app to your account. Both the bare token and the whole ./clo set token … command work.
2. In the add-on open the Configuration tab, paste the key and add a publication: name homeassistant, type http, address homeassistant:8123.
3. Save, start the add-on and enable start on boot.

The same in YAML mode:

token: YOUR_API_KEY
clo_log_level: info
services:
  - name: homeassistant
    type: http
    local_addr: homeassistant:8123

You can set just homeassistant without a port and the client detects it. An explicit :8123 is more reliable, especially if you changed the port. All options are in the add-on documentation.

Where to find the CloudPub URL

After starting, open the add-on Log tab: it shows a URL like https://….cloudpub.ru. That URL opens Home Assistant from any network. The same link and traffic stats are in the dashboard. The address is tied to the agent and normally stays the same when the add-on restarts.

External URL in Home Assistant and the mobile app

• In Home Assistant: Settings → System → Network, Home Assistant URL block, Internet field — paste the external URL. It is used for links in notifications and by integrations.
• In the phone app: Settings → Companion app → your server → External URL.
• Also set your home Wi-Fi there: at home the app connects directly over the local address, and away from home through the tunnel.

How to test Home Assistant remote access

Turn off Wi-Fi on your phone and open the URL over mobile data — the honest test that Home Assistant without a public IP is reachable from outside. You should see the login page with the HTTPS padlock in the address bar. From a computer, check it with:

curl -I https://your-address.cloudpub.ru

• 200 — everything works;
• 400 — the reverse proxy is not configured in Home Assistant;
• 502 or 504 — the tunnel is up but the client cannot reach homeassistant:8123: check the publication address and port.

After logging in, check the Home Assistant log: there should be no untrusted proxy warnings or failed logins from your address.

How to secure Home Assistant with remote access

Once published, the Home Assistant login page is visible to the whole internet, and bots will start guessing passwords. The minimum protection:

• Two-factor authentication. Profile → Security tab → Multi-factor authentication modules → enable TOTP and scan the QR code with an app such as Aegis or 2FAS. Do it for every user.
• IP banning. In Settings → System → Network → HTTP server turn on IP banning and set login attempts before ban, for example 5. Thanks to the X-Forwarded-For setting the attacker’s address is banned, not the tunnel. Banned addresses go to ip_bans.yaml.
• A separate non-admin user for phones used by family members.
• A long unique password and timely Home Assistant updates.
• Publish only what you need. Avoid exposing router or NAS admin pages through the tunnel.
• Backups before opening the system up — for example, Home Assistant Google Drive Backup.

More on HTTP server settings is in the Home Assistant documentation.

Publishing other services through CloudPub

The add-on supports http, https, tcp, udp, rtsp, rdp, vnc and 1c publications. Everything except HTTP and HTTPS requires the PRO plan. An example with the Mosquitto MQTT broker and the router web UI:

services:
  - name: homeassistant
    type: http
    local_addr: homeassistant:8123
  - name: mqtt
    type: tcp
    local_addr: core-mosquitto:1883
  - name: router
    type: http
    local_addr: 192.168.1.1:80

If you run Nginx Proxy Manager, publish a0d7b954-nginxproxymanager:80 as http and add a proxy host for the assigned subdomain — one tunnel can then serve several services. For camera video, WebRTC inside Home Assistant, as in the Aqara G4 and go2rtc guide, works better than a separate RTSP publication.

CloudPub for Home Assistant Container and Core

Without the Supervisor there are no add-ons, but the service has an official Docker image. If Home Assistant runs with network_mode: host, add the client to the same docker-compose.yml:

services:
  cloudpub:
    image: cloudpub/cloudpub:latest
    container_name: tunnel
    network_mode: host
    restart: unless-stopped
    environment:
      - TOKEN=YOUR_API_KEY
      - HTTP=8123
    command: run
    volumes:
      - agent-config:/home/cloudpub

volumes:
  agent-config:

Start the container and get the URL from the log:

docker compose up -d
docker logs tunnel | grep https

The agent-config volume keeps the agent settings; without it every restart gives you a new address. On a Raspberry Pi and other ARM devices use the cloudpub/cloudpub:latest-arm64 image. In the Home Assistant HTTP server settings set the trusted proxies to 127.0.0.1 and ::1, since the client connects to Home Assistant locally.

CloudPub vs Nabu Casa, Cloudflare Tunnel, Tailscale and OpenZiti

Solution	How it works	Own domain	Price	Best for
CloudPub	HTTPS tunnel, cloudpub.ru address	not needed	free for the web UI	a quick start without a public IP
Nabu Casa	official Home Assistant cloud	not needed	paid subscription	supporting the project and connecting Alexa or Google Assistant
Cloudflare Tunnel	tunnel through the Cloudflare network	required	free	people who own a domain
Tailscale or WireGuard	VPN into the home network	not needed	free	personal access with no public login page
OpenZiti	zero trust on your own VPS	required	VPS cost	hiding services completely

This tunnel is the simplest way to reach Home Assistant without a public IP: a public address with no domain or VPS, for the app, notifications and integrations. If only you need access, a VPN or OpenZiti is safer — the login page is not visible from the internet at all. Prepare your VPS for that with the security checklist.

How to turn off CloudPub remote access

1. Stop the add-on and disable start on boot — the URL stops working immediately.
2. To close a single service, remove its publication from the add-on configuration and restart it.
3. Remove unused publications and agents in the dashboard, especially if the token may have leaked.
4. Clear the Internet URL in the Home Assistant network settings and the external URL in the Companion app.

If CloudPub does not open

• 400: Bad Request — X-Forwarded-For is off or the 172.30.33.0/24 proxy is missing; find the exact address in the log by searching for untrusted proxy.
• Timeout while running clo ls — the client cannot reach the service’s servers. A common cause is a filtering DNS resolver such as Quad9 blocking the domain. Check with nslookup cloudpub.ru in the Terminal & SSH add-on and switch DNS or allow-list the domain.
• The tunnel drops or the client hangs — set the log level to debug, restart the add-on and check the Log tab.
• The phone app does not connect away from home — check the external URL in the Companion app settings and that the address opens in the phone browser over mobile data.

Ask add-on questions in GitHub Discussions and service questions via the service support.

CloudPub and Home Assistant FAQ