Keys stay on your devices
WireGuard private keys are generated on your devices and are not transmitted to HomeTunnel.
Trust & architecture
Security boundaries you can reason about.
HomeTunnel uses a Portal control plane and a NetBird data plane. Authorization is server-side, routes are explicit, and encrypted connections prefer a direct path while retaining a relay fallback for difficult networks.
Security promise
Bounded claims, enforced paths.
Traffic contents stay encrypted
HomeTunnel does not decrypt peer-to-peer traffic. Relay fallback remains end-to-end WireGuard-encrypted.
Access stays service-scoped
Home Assistant uses its host on TCP 8123. Custom routes name one IPv4 host and one TCP port.
Homes stay separate
Every home receives isolated groups, policies, routes, and route distribution scoped to that home and owner.
Architecture
Four layers define who can reach what.
Group layerDevices are placed into home-scoped groups.identity
Policy layerServer-side policy authorizes communication.policy
Route layerHome Assistant plus up to three custom host-only routes per home.routing
Distribution chainOnly assigned client devices receive a home's routes.isolation
Enforced path
Client device
Access policy
Distribution peer
HAOS routing peer
HA host: TCP 8123 or a custom host + port
How the backend works
Control and connectivity have different jobs.
Portal · control plane
The Portal is responsible for identity, homes, devices, authorization, plan enforcement, routing authority, and billing. It is the only HomeTunnel component that calls the NetBird management API.
Enrollment uses short-lived, single-use, home-scoped setup keys. Client devices and the HAOS add-on do not receive NetBird administrator credentials.
NetBird · data plane
NetBird provides the open-source WireGuard mesh. The Portal creates and reconciles the groups, policies, routes, and route distribution for each home automatically.
Connections use NAT traversal and prefer peer-to-peer paths. If a direct path is blocked, the open-source NetBird relay forwards end-to-end encrypted packets it cannot decrypt.
What HomeTunnel cannot do
Limits are part of the model.
The design narrows access, but the Portal remains authoritative for coordination and authorization.
Cannot read WireGuard traffic contentsPrivate keys remain on user devices; relay traffic stays encrypted end to end.
Does not provide broad LAN accessRoutes identify a host and TCP port, not a subnet.
Cannot guarantee a direct pathNAT, CGNAT, or firewalls can require encrypted relay fallback.
Does not eliminate control-plane dependencyEstablished P2P connections may continue during an outage; new connections and coordination need the service online.
Skeptic FAQ
Questions the architecture should answer.
What if the HomeTunnel Portal is compromised?
We maintain and audit HomeTunnel infrastructure to reduce the risk of unauthorized access and known vulnerabilities. However, a compromise of the control plane could affect authorization, routing, device enrollment, and network-policy decisions.
HomeTunnel would still not possess the WireGuard private keys generated by enrolled devices. However, it would be inaccurate to claim that a control-plane compromise would have no security impact.
We use layered security controls, restricted administrative access, monitoring, patch management, and infrastructure hardening to protect the platform. We treat access to a user’s home network as a high-security responsibility.
Does traffic pass through HomeTunnel infrastructure?
Connections are peer-to-peer whenever network conditions allow.
When firewalls, carrier-grade NAT, or other network restrictions prevent a direct connection, traffic may pass through a NetBird relay. Relayed traffic remains end-to-end encrypted with WireGuard, and the relay cannot decrypt or read the traffic.
Can one home reach another?
No. HomeTunnel does not provision cross-home routes or shared network paths.
Each home receives isolated NetBird resources that are scoped to that home and its authorized owner. This isolation also allows different homes to use identical private IP address ranges without creating shared access between them.
What happens if HomeTunnel is unavailable?
HomeTunnel is designed with service availability and recovery in mind. However, no online service can guarantee uninterrupted availability.
Existing peer-to-peer connections may continue operating during a temporary service interruption. New connections, device coordination, enrollment, authorization changes, and route reconciliation require the HomeTunnel service to be available.
Do you expose the entire Home Assistant network?
No. By default, HomeTunnel exposes only the Home Assistant host on TCP port 8123.
A home may also have optional custom routes. Each custom route is restricted to one IPv4 host and one TCP port. HomeTunnel does not provide unrestricted access to the entire home subnet.
How do I activate or manage a HomeTunnel subscription?
HomeTunnel subscriptions can only be activated and managed through the HomeTunnel web app at https://my.hometunnel.io.
Subscription purchases are not available through the Android or iOS apps. Sign in to the web app to start a subscription, change your plan, review your billing status, or access available billing-management options.