What's the safest way to control devices from outside of local network?

[reinisb]

Hi folks!

I have a Raspberry Pi running RaspberryMatic. In order to control my devices, I use the default RaspberryMatic web interface. Until now I have only used the web interface from my local network, but now I have a need to control my devices from outside of my local network (e.g. from my iPhone when driving home).

An obvious way to do this would be to give my raspberry a static local IP address in my router, open port 80 for that static IP in my router, and then access RaspberryMatic web interface by entering my raspberry Pi's public IP. It would work, but my main concern is safety. Would there be basic HTTP auth? If so, where can I configure it and would that be safe enough? If there would be no basic HTTP auth, opening that public IP it would simply open the RaspberyMatic web login screen, right? I would then need to hope that potential hackers would not guess my RaspberryMatic username/password.

Can someone please comment if this is safe? Or perhaps there is a better free solution that would allow controlling my devices from outside of my local network in a safer way?

Thanks!

[jens-maus]

An obvious way to do this would be to give my raspberry a static local IP address in my router, open port 80 for that static IP in my router, and then access RaspberryMatic web interface by entering my raspberry Pi's public IP.

Never, never, never 👎 do this! The WebUI of a CCU (thus also RaspberryMatic) is not - and never will be - safe to be accessible through simple port forwarding like you outline here.

Thus the only secure way to get your CCU/RaspberryMatic accessible from the internet is by using a VPN connection! So there are plenty of free VPN solutions out there - one is btw by using The internal VPN connectivity of your FritzBox or other similar router.

But again: NEVER make your CCU accessible via simple port forwarding. The CCU WebUI has so many technical/security design flaws that it is very easy to take over full control of a CCU/WebUI even without knowing your login credentials and even if you use https!

[reinisb]

Thanks for the quick response! Alright, I will never make CCU accessible via simple port forwarding.

If I were to go with the VPN approach, then this means that whenever I would want to control my device from my iPhone, I would first need to connect my iPhone's VPN client to the VPN server and then I could access CCU web interface, right?

Is there perhaps a more elegant and user-friendly approach than VPN, but with similar safety?

[blackbasket]

If you want to use the Home App or Eve App, you can just install i.e. hap-homematic and setup a central on a HomePod or better Apple TV.

Don't use iPads ;)

As alternative solution you may have a look at Cloudmatic, which is a native CCU plug-in. But this would cost some money per year.

[reinisb]

If you want to use the Home App or Eve App, you can just install i.e. hap-homematic and setup a central on a HomePod or better Apple TV.

Don't use iPads ;)

Yeah, I actually tried using hap-homematic to control my garage doors for 6 months, but it was so unstable that it was basically unusable (my garage doors were almost always showing "Not responding" inside the Home app). Controlling the garage doors works perfectly every time from RaspberyMatic web interface, but is almost not working at all through hap-homematic. Other homekit devices running outside of hap-homematic work perfectly every time as well, hence in my case the culprit seems to be hap-homematic.

I guess I will need to look into Cloudmatic

[jens-maus]

If I were to go with the VPN approach, then this means that whenever I would want to control my device from my iPhone, I would first need to connect my iPhone's VPN client to the VPN server and then I could access CCU web interface, right?

There is really IMHO no reason to directly access the webui for controlling your devices. The WebUI of a CCU/RaspberryMatic is only meant to setup and configure devices and programs. If you want to check the status or switch a device you use Smartphone Apps like pocketControl (iPhone/iPad) or tinyMatic (Android). And in case of pocketControl this app even allows to automatically connect via the iOS setup VPN connection once the app is started. Or you use paid third-party services like CloudMatic to connect to your CCU via a secure VPN connections.