What I seek is a service that will handle secure authentication outside of my network, and redirect traffic towards me only after it has been proven to be from my allow list: 'this is someone you trust, so we're letting them reach your next layer of security'. I will watch the whole session.įor me specifically, when it comes to hardware that's running on my home network, I would be more comfortable if the bar were higher than 'this is a known bad actor, so we're keeping them out' or even 'this behavior is suspicious, so we're kicking them out and letting others know'. I applaud all efforts to make security more accessible to more people, so thank you for sharing this, Klaus. Nice, I've heard of CrowdSec before and I've always thought of it as fail2ban on steroids, and the first 10min of your talk confirmed my understanding of it. So it does require some work and maintenance.ĮDIT: thank you for the award anonymous Redditor! This does require you to set additional rules for split-tunnel or to disable inspection for some apps which use certificate pinning. As a bonus all traffic from/to my phone is now encrypted whenever I am not connected to my local network.ĭisclaimer: the setup does require some tuning, and it does require you to enable 'TLS Decryption' in Cloudflare. I replicated the exact same setup for my nas so now I can reach my Synology publicly in a secure way. In all, I now have a solution where I can use the app on my phone without any restrictions, and I can still login to HA form any other computer (should I need to) with an addional o365 two-factor login. Set Cloudflare Access to bypass the additional o365 login ONLY when connecting from a client through WARP which is linked to my account. tihs authentication happens before traffic even reaches my network. Set Cloudflare access to protect the public access to my HA instance with an additional o365 login. Install the Cloudflare Certificate on these devices.Īuthorize Cloudflare to use my o365 as identity / authentication provider. Install Cloudflare WARP (aka 1.1.1.1) on my iOS devices, and link it to my Cloudflare Teams. The local end of the tunnel runs on a Docker container in my NAS. Set up a Cloudflare tunnel to my local HA instance. Set up Cloudflare for Teams (aka Cloudflare Zero Trust) The solution I implemented is as follows:

Should be accessible form any other computer Long story short: if you use Nabu Casa Cloud, the only line of defence you have against hackers is the built-in security of Home Assistant. A few months ago I posted about my concerns with security using Nabu Casa Remote UI.

Ha tunnel ios