Documentation
Smart-home VPN: remote home automation without cloud exposure
A smart home is at its best when it stays local: fast automations, private data and devices that keep working when a cloud fails. The challenge begins when the phone leaves Wi-Fi. A smart-home mesh VPN extends the private network to that phone, another property or a maintainer without publishing Home Assistant, Jeedom, cameras or a NAS on the public Internet.
What this enables in practice
Control and verify
Adjust heating, open a gate, inspect an alarm or confirm that an automation ran while away.
Watch without publishing
Open private dashboards, NVRs and camera streams without a public URL, reverse proxy or forwarded application port.
Maintain remotely
Administer Home Assistant, Jeedom, MQTT, Node-RED, Zigbee2MQTT, ESPHome, a NAS or Raspberry Pi at private addresses.
Connect properties
Share selected services across a home, workshop and holiday property without blindly merging every LAN.
Grant narrow support access
Give a contractor temporary access to one device and port, then revoke it without sharing router credentials.
Keep data local
Voice, occupancy, habits and video can remain processed on hardware inside the home.
Why a private VPN beats an exposed dashboard
| Approach | Benefit | Trade-off |
|---|---|---|
| Vendor cloud | Simple access from anywhere | Account, provider and Internet dependency |
| Port forward / reverse proxy | Full technical control | A public service to harden, monitor and patch |
| Router VPN | Private LAN access | Inbound configuration, profiles and CGNAT limits |
| Mesh VPN | Outbound nodes, identity, ACLs and stable addresses | A node or gateway must stay online at the site |
Home Assistant’s own documentation recommends managed cloud access or a VPN for remote use and warns that merely forwarding a port is not secure. A mesh retains the VPN’s privacy while removing the single concentrator and inbound configuration from ordinary nodes.
Home Assistant, Jeedom, Matter and MQTT across the mesh
| Technology | Purpose | Recommended handling |
|---|---|---|
| HTTP/HTTPS and WebSocket | Home Assistant/Jeedom UI and live state | Direct private connection by mesh name or address |
| MQTT | IoT sensors, commands and telemetry | Private broker, per-client ACLs and application TLS where needed |
| mDNS / Bonjour | .local service discovery | Encrypted multicast among approved members |
| SSDP / UPnP | Media and device discovery | Controlled discovery, never Internet exposure |
| Matter over IP | Lighting, locks, HVAC and energy | Keep a local controller at home; remotely reach the controller |
| Thread / Zigbee / Z-Wave | Low-power sensor radio networks | Remain local; reach their hub or border router over IP |
| RTSP / ONVIF | Cameras and NVR | Private streams with separate viewer and administrator rights |
Recommended home architecture
- 1Install an always-on nodeRun VIGIL-MESH on Home Assistant or Jeedom when supported, or use a small Ethernet-connected Linux host.
- 2Enable the LAN gatewaySelect the physical interface and approve each useful host separately: automation server, NVR, NAS, printer or EV charger.
- 3Create identity groupsSeparate owners, family, guests, contractors and automations. Access to a thermostat must not imply access to a NAS.
- 4Allow only required servicesLimit ACLs to the destinations and ports that each group needs. A private network is not a reason for broad trust.
- 5Test over cellularDisable phone Wi-Fi and verify dashboards, notifications, video, session recovery and fallback procedures.
The Home Assistant guide and the Jeedom guide cover URLs, mobile apps and platform-specific troubleshooting.
What a private vigie on the router improves
A home vigie provides a relay under your control whenever peers cannot establish a direct path. It can run in a Freebox Ultra or Delta VM, or on a mini-PC, NAS or Raspberry Pi behind any other router.
- Relayed traffic for your workspace stays on infrastructure you selected.
- The relay sits close to home services and remains available while the router and line are up.
- A second off-site vigie avoids making the home broadband line the only rendezvous point.
- The LAN gateway and vigie may coexist, but keep their network roles and policies distinct.
See compatible ISP boxes and the Freebox VM deployment guide.
Security and availability rules
- No public admin dashboards — keep management interfaces on the LAN and mesh.
- Separate accounts and MFA — a VPN is a network layer, not a replacement for application authentication.
- Minimum ACLs — an HVAC contractor needs neither cameras nor NAS access.
- Patch every layer — router, VM, platform, plugins, cameras and IoT firmware all matter.
- Local degraded mode — locks, heating, alarms and lighting must not require a permanent WAN link.
- Recovery — retain physical access, backups and optionally cellular failover.