New setup of duckdns and port forwarding | Home Assistant | Page 1

proper moth Aug 21, 2025, 11:48 PM

#

I'm new-ish to HA and have been trying to setup duckdns following this guide (https://smarthomeaddict.co.uk/2022/07/home-assistant-remote-access-using-duckdns-and-letsencrypt/) but HA isn't accessible. Locally I can visit https://homeassistant.local:8123 (not secure) but when visiting from the app, on the same network, I get an certificate mismatch in the mobile app.

In additional, trying to access the website off network, I get ERR_CONNECTION_TIMED_OUT in the browser but I have setup port forwarding.

So I think I've one or two issues.

My SSL cert isn't allowing mobile login via the app (Android)
My website isn't reachable, from the web

Smart Home Addict

smarthomeaddict

Home Assistant Remote Access using DuckDNS and LetsEncrypt - Smart ...

In this guide we will cover setting up remote access using DuckDNS, and using LetsEncrypt to secure the connection. Why

late valley Aug 22, 2025, 8:51 AM

#

I think the app doesn't allow ignoring SSL errors, you have to use the same URL for accessing HA internally. You could then point the domain to your HA's local IP address in your routers DNS server.
About the connectivity from outside, verify that duckdns correctly updates the IP.

slender turret Aug 22, 2025, 10:16 AM

#

Firstly, my advice is to stop - there have been quite a few post with people having issues when updating to 2025.8.x - in addition DuckDNS seems to have been suffering more and more outages over time.

You should see if your router supports a Dynamic DNS provider and set that up. Something like https://www.noip.com/ This provides the added benefit that your router will update the server when the IP address changes - with the DuckDNS add-on there may be a delay as the add-on has to poll to see when the address changes.

Then install the Nginx Proxy Manager addon - This will allow you to use Let's Encrypt to get a certificate for the name you set-up in the Dynamic DNS provider. It also means you only need to add the IP Address for the Mginx Proxy Manager Addon to your trusted_proxes setting in configuration.yaml (ie. you are not converting your HA to use SSL by default)

If you still want help with the DuckDNS set-up you are trying to do, I can try but have a few questions:

1). Locally I can visit https://homeassistant.local:8123/ (not secure) - what do you mean by 'not secure'? do you get a certificate warning? Are you sure you are using 'https://' and not 'http://'
2). What do you have for external_url and internal_url in the mobile app? You can mask private data by saying xxxx.duckdns.org or [host].duckdns.org
3). Can you confirm DuckDNS has the correct IP? You can visit https://whatismyipaddress.com/ which should show your public ip and compare it to the one in DuckDNS.
4). What ports have you forwarded on your router (both from - to).
5). Confirm that you are forwarding from the router to the IP Address of your HA Server.
6). Tell us the changes you made in configuration.yaml for http:

No-IP | Smarter DNS Starts Here

No-IP is a Free Dynamic DNS and Managed DNS provider with 100% uptime. Get free DDNS, plus domain registration and SSL certificates, for home and business

late valley Aug 22, 2025, 10:25 AM

#

yeah, that's basically what I did too, moved my domain to namecheap and I use their dyndns service instead and use it directly on the router. For the certificate I switched to the let's encrypt add-on.

proper moth Aug 22, 2025, 5:03 PM

#

slender turret Firstly, my advice is to stop - there have been quite a few post with people hav...

I get a cert warning. HA is only accessible via HTTPS
It'd be xxx.duckdns.org
WIP
I've setup both external ports 80 and 433 to internal port 8123 and IP
Router is showing the correct internal IP for HA
Only change I've made to the configuration.yaml is added http:

  # server_port: 443
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem```

#

I did try a tracert on my domain (xxx.duckdns.org) but it fails a lot. So I am thinking my router blocking outside traffic. Least that is my current guess

#

Fixing the certs I am a little less sure about. HA shows some certs, so not sure why they'd be Not secure and preventing me from adding it via mobile

slender turret Aug 22, 2025, 5:09 PM

#

Which router is it?

proper moth Aug 22, 2025, 5:10 PM

#

A crappy Linksys Smart Wifi node

#

Older model of these:

slender turret Aug 22, 2025, 5:11 PM

#

Are you just on your mobile or on a PC connected to your network?

#

also what os is the pc?

proper moth Aug 22, 2025, 5:12 PM

#

HA is on a separate computer than what I am currently running. A raspberry pi specifically. I connected via browser on a win11 PC.

slender turret Aug 22, 2025, 5:14 PM

#

ok, first lets get the internal ip of the HA server. open a command prompt and type ping homeassistant.local

proper moth Aug 22, 2025, 5:15 PM

#

Reponse is just a mac address. I got the IP from my router.

#

Using ping -a homeassistant.local I can confirm it's the correct IP

slender turret Aug 22, 2025, 5:16 PM

#

good

#

now type ping xxx.duckdns.org

#

where xxx is your host

#

is it giving the same ip or a different one

proper moth Aug 22, 2025, 5:17 PM

#

Ping request timeouts

slender turret Aug 22, 2025, 5:17 PM

#

don't care about timeouts - just want ip address checks

proper moth Aug 22, 2025, 5:18 PM

#

Oh, I see what you mean. My ping was showing the internal IP, you want to to see if the external IP match?

I'd to check what HA external IP is currently. Give me a sec

slender turret Aug 22, 2025, 5:19 PM

#

no, I want to see that when you are using your PC do you get the same IP Address or different

#

if you get an external public address when looking up xxx.duckdns.org we will probably need to add port 8123 forwarded to HA server on the router

proper moth Aug 22, 2025, 5:21 PM

#

Ah, same as duckdns? Yes they match

slender turret Aug 22, 2025, 5:21 PM

#

when you say they match, the two lookups on the pc both gave the same internal ip?

#

or the IP matched with the one at DuckDNS

proper moth Aug 22, 2025, 5:22 PM

#

The ping to xxx.duckdns.org matchs the IP listed in duckdns.org

#

not my internal IP

slender turret Aug 22, 2025, 5:23 PM

#

ok, add a port forward for 8123 to your router like you did for 443 - you can remove the one for 80

proper moth Aug 22, 2025, 5:23 PM

#

slender turret Aug 22, 2025, 5:24 PM

#

yes, add one that is 8123 to 8123

proper moth Aug 22, 2025, 5:24 PM

#

Done

slender turret Aug 22, 2025, 5:25 PM

#

now try https://xxx.duckdns.org:8123

proper moth Aug 22, 2025, 5:26 PM

#

Still that ugly ERR_CONNECTION_TIMED_OUT

late valley Aug 22, 2025, 5:27 PM

#

sure port 433 correct? Shouldn't it be 443?

slender turret Aug 22, 2025, 5:27 PM

#

late valley sure port 433 correct? Shouldn't it be 443?

great spot!

#

although https://xxx.duckdns.org:8123/ should have worked

late valley Aug 22, 2025, 5:29 PM

#

nope, if you forward port 443 then the external url is https://xxx.duckdns.org

slender turret Aug 22, 2025, 5:30 PM

#

"yes, add one that is 8123 to 8123"

proper moth Aug 22, 2025, 5:30 PM

#

Right, either should have worked. Maybe its my ISP?

late valley Aug 22, 2025, 5:31 PM

#

why are we using xxx as example? feels like we are talking about a porn website 😂

slender turret Aug 22, 2025, 5:31 PM

#

the 433 to 8123 would need to be https://xxx.duckdns.org:433/

slender turret Aug 22, 2025, 5:32 PM

#

late valley why are we using xxx as example? feels like we are talking about a porn website...

added privacy since its a public hostname - plus what is wrong with porn?

proper moth Aug 22, 2025, 5:32 PM

#

Its what the internet is built for, if you believe the song.

late valley Aug 22, 2025, 5:33 PM

#

oh, haven't thought of that song for a pretty long time, but i remember ^^

slender turret Aug 22, 2025, 5:34 PM

#

back to the fix, change the 433 to 443

proper moth Aug 22, 2025, 5:35 PM

#

oh, yikes. Not sure how I missed that

#

Well, now my routers IP is directing me to HA

slender turret Aug 22, 2025, 5:39 PM

#

so, now you should also be able to remove the 8123 forward we added.

You would use https://xxx.duckdns.org for both internal and external

proper moth Aug 22, 2025, 5:39 PM

#

If I get somehow get back to my router settings.

slender turret Aug 22, 2025, 5:40 PM

#

However, I do recommend you add a proxy server rather than just exposing the HA Web Interface direct to the Internet

proper moth Aug 22, 2025, 5:41 PM

#

baby steps.

proper moth Aug 22, 2025, 5:46 PM

#

slender turret so, now you should also be able to remove the 8123 forward we added. You would ...

I think adjusting my port fwd has locked my out of my router.

#

Ah, thank god, port 80 still works

late valley Aug 22, 2025, 5:49 PM

#

maybe use also 8123 as external port

proper moth Aug 22, 2025, 5:50 PM

#

Unfortunately still no luck. Bowser still giving me a ERR_CONNECTION_TIMED_OUT

#

There must be something I am missing with my router.

proper moth Aug 22, 2025, 6:33 PM

#

Looking into my ISP, some suggest that it uses something called CGNAT. Which prevents my router from having a "real" public IP. I think my end solution is to use Nginx Proxy Manger as you've suggested before.

#

Unfortunately my shitty router doesn't show my WAN IP anywhere so I cannot confirm it. But at this point it makes the most sense.

slender turret Aug 23, 2025, 9:01 AM

#

Which ISP is it? If it is running CGNAT then you won't be able to get external connections since you don't really have a Public IP address. You ISP has the Public IP address and would need to port forward to your CGNAT IP Address (they won't do this).

Solutions:

1). Ask ISP if they can provide a static IP Address - they will charge an additional fee for this if they offfer the service
2). Use a VPS (Virtual Private Server) and create a VPN from your network to the VPS. The VPS will forward the traffic to your network over the VPN.

#

3). Sign up to Nabu Casa cloud - HA will connect to their cloud servers

late valley Aug 23, 2025, 9:27 AM

#

4). Change to a different ISP 🤷🏼

merry berry Aug 24, 2025, 1:10 PM

#

@slender turret @late valley If I have Nabu Casa account and signed in on HA, why would my duckdns still not work?

slender turret Aug 24, 2025, 1:51 PM

#

I don't use Nabu Casa, so not sure, but as they put it through their cloud they would would provide the domain. That means no need for DuckDNS

merry berry Aug 24, 2025, 1:56 PM

#

I have been trying to get my HA Voice going, but the 1 issue that I face, is that it says I don't have access to my microphone, due to the fact that my ui is "not secure". This being accessing my HA server on my local network, from my pc, to my HA server(Pi5), via http instead of https

manic jetty Aug 24, 2025, 3:47 PM

#

merry berry <@1204762875600572426> <@363996043450515458> If I have Nabu Casa account and sig...

when you set up your ha to use the nabu casa cloud service your ha connects outbound to nabu casa. and you get a nabu casa url to use as external address in the app. nabu casa then jost connects those two together. no need for messing with inbound connections through your isp and router. using nabu casa will not have any effect on duckdns problems

#

i do have inbound access to my home network through duckdns and nginx proxy manager (not running on ha), but i do not use that for ha.

slender turret Aug 26, 2025, 10:51 AM

#

manic jetty when you set up your ha to use the nabu casa cloud service your ha connects outb...

For my personal education, can you set a custom hostname when you sign up to Nabu Casa or do you have to use the external address they provide?

OP, being able to set a custom hostname won't make a difference for you since you are behind CGNAT and cannot receive inbound connections. The custom hostname would allow you to register a domain name and use that instead of the Nabu Casa provided one.

#

Answering my own question:

https://support.nabucasa.com/hc/en-us/articles/26497540527517-Using-remote-access-with-a-custom-domain-for-Home-Assistant

Nabu Casa

Using remote access with a custom domain for Home Assistant

If you own your own domain (like example.com), you might want to use a subdomain of that domain name (like home.example.com) to have a familiar URL to your Home Assistant instance, in addition to t...

manic jetty Aug 26, 2025, 11:03 AM

#

i have not really bothered with my own domain name for nabu casa as i use the app when away from home.

for other (non ha) stuff that hits my nginx proxy i have multiple cname records in my dns domain that all point to the same duckdns name. the nginx proxy then uses the hostname in the url to decide which backend to route to.

slender turret Aug 26, 2025, 2:42 PM

#

manic jetty i have not really bothered with my own domain name for nabu casa as i use the ap...

That is the correct set-up, although it should be noted that DuckDNS name is pointed at your router's WAN IP. The router forwards the traffic to your Nginx Proxy. In theory this means if you use the DuckDNS name on your internal network traffic gets sent to your router and then reflected back to the Nginx Proxy (most routers automatically set up reflection when setting up port forwarding).

manic jetty Aug 26, 2025, 8:52 PM

#

not all routers can handle that. but internally my domain is handled by my freeipa cluster, so internally those names resolve differently anyway 🙂

slender turret Aug 27, 2025, 11:07 AM

#

manic jetty not all routers can handle that. but internally my domain is handled by my freei...

All routers that handle reflection (NAT Hairpin) when setting up a port forward will handle it correctly, since you don't need to set-up any custom DNS entries and the upstream name servers will query the DuckDNS servers.

By running FreeIPA you are using Split-Horizon DNS (running a local DNS that resolves with different information to the upstream servers).

I'm not saying there is anything wrong in doing this, however, it isn't a straight forward set-up and hopefully you have reasons for running this at home.

manic jetty Aug 27, 2025, 4:26 PM

#

my home lab contains up to 40Gb networks... and a blade enclosure... it's a mess, but it's my mess 😛

so - yes - i need both the split dns, ldap, kerberos... and some day i'll look into the cert and key handling.

south gorge Aug 28, 2025, 7:31 PM

#

slender turret All routers that handle reflection (NAT Hairpin) when setting up a port forwar...

Is that the term eh? For our product (Linux based iptables firewall with many knobs on) we called them “reflective portforwards” in the UI and documentation. But I always called them “bouncy port forwards” in the code. 😀

#

My preference is Wireguard. No messing with DNS. iOS has a client, Macs have a client. I’m quite sure everything has a client these days. Put it on an obscure port and DROP all state=new traffic except that port and you are done.

#

Duckdns is of course awesome. Used to have to install binaries for that kind of thing, now it’s just a curl one liner.

slender turret Aug 28, 2025, 7:50 PM

#

south gorge My preference is Wireguard. No messing with DNS. iOS has a client, Macs have a c...

Wireguard is good for setting up a vpn, but not the same as port forwarding especially if you need a third party to connect to a single service such as an Amazon skill.

south gorge Aug 28, 2025, 8:02 PM

#

That kind of scenario scares me to death. Can you at least limit the DNAT by client IP? I wouldn’t trust any authentication scheme really.

#New setup of duckdns and port forwarding