docker on Marcin Zabłocki blog

How to connect to Home Assistant from anywhere using NordVPN meshnet

Marcin Zabłocki — Sat, 03 Jan 2026 15:52:00 +0000

So you have your Home Assistant working just fine, but you can only access it on your mobile app while you’re at home. I had the same problem, but I wanted to be able to play with my LED lights and power switches remotely, without having to pay for Home Assistant Cloud. I already had NordVPN at hand and I knew it had Meshnet, so it was a great opportunity to use it.

What is NordVPN Meshnet?

Meshnet is NordVPN’s peer-to-peer networking feature that lets you connect multiple devices into a private virtual network. Unlike traditional VPN services that route traffic through a central server, Meshnet creates direct connections between your devices, giving you lower latency and the ability to access services (like Home Assistant) on any device in your mesh without exposing them to the public internet.

The best part? Meshnet is completely free. You don’t need a special subscription beyond the standard NordVPN subscription, and it works on Windows, macOS, Linux, iOS, and Android. You can add up to 60 devices to a single Meshnet, which is more than enough for most home setups.

Each device in your Meshnet gets assigned a unique device name (like homeassistant-linux in my case, which is the actual NordVPN Meshnet name of my Home Assistant server) and a private IP address in the 100.64.0.0/10 range. This makes it easy to remember and access your services by name, similar to how you’d use DNS.

How it works in practice

When you enable Meshnet on both your Home Assistant server and your client device, they can communicate directly over an encrypted tunnel. Port forwarding, dynamic DNS, and exposing your server to the internet are all unnecessary. It’s just a private network between your devices.

The problem I ran into (and you probably will too) is that Meshnet blocks access to Docker containers and local networks by default. This guide shows you exactly how to fix it.

Quick solution summary

If you just want the steps without the explanation, here’s what you need to do:

Enable UFW firewall on your Linux server
Add a rule: sudo ufw allow in on nordlynx to any port 8123 proto tcp
Grant Meshnet access: sudo nordvpn meshnet peer local allow <your-device-name>
Test with: curl http://homeassistant-linux:8123 (replace with your actual Meshnet device name)

The key insight: Meshnet treats Docker networks as “local” and blocks access by default. That’s why SSH works but Home Assistant doesn’t. The peer local allow command fixes this.

Meshnet configuration on iOS

Once everything is set up correctly, you will be able to access Home Assistant remotely, e.g. when you’re out of home on iOS:

Prerequisites

Before you start, make sure you have:

A Linux server running Home Assistant (preferably in Docker with docker-compose)
NordVPN installed on that Linux server
NordVPN Meshnet enabled on both your Home Assistant server and your client device
UFW firewall (Uncomplicated Firewall) installed on the Linux server
At least one other device with NordVPN Meshnet enabled to test the connection

If you’re running Home Assistant in Docker, your setup should look something like this:

yaml

# ... other services skipped
services:
  homeassistant:
    container_name: homeassistant
    image: ghcr.io/home-assistant/home-assistant:stable
    restart: always
    volumes:
      - ./data/homeassistant:/config
    ports:
      - 8123:8123
    networks:
      - ha_net

networks:
  ha_net:
    driver: bridge

Diagnostic steps: How to debug “Home Assistant not working on meshnet”

Check if Home Assistant is actually listening

From the Linux server itself, verify the port is exposed:

bash

docker ps | grep homeassistant

You should see 0.0.0.0:8123->8123/tcp in the PORTS column. If you see something else, your Docker port mapping is misconfigured.

Also check if something is listening:

bash

sudo ss -tulpn | grep 8123

bash

sudo netstat -tulpn | grep 8123

You should see a line with LISTEN on 0.0.0.0:8123 or :::8123.

Verify the local network path works first

From another device on your LAN, try accessing Home Assistant using the server’s local IP:

bash

curl -v http://192.168.x.x:8123

or if you prefer a simple port check:

bash

nc -vz 192.168.x.x 8123

You should get an HTTP response or “succeeded” message. If this fails, your Docker setup or local network is broken. Fix this before moving on.

Test the meshnet connection itself

From your client device that has Meshnet enabled, try to reach SSH first:

bash

nc -vz <meshnet-device-name> 22

Replace <meshnet-device-name> with the device name from Meshnet (like the homeassistant-linux name in your Meshnet settings). If SSH works, Meshnet itself is working.

Now try Home Assistant:

bash

nc -vz <meshnet-device-name> 8123

If SSH succeeds but this fails, you’ve found the exact problem: Meshnet is blocking traffic to port 8123 specifically.

Understand why SSH works but Home Assistant doesn’t

SSH works because it binds to the host’s nordlynx interface directly. Home Assistant runs inside a Docker container on a bridge network (172.17.0.0/16 range by default). Meshnet treats Docker networks as “local networks” and blocks peer access to them unless you explicitly grant permission.

The complete solution: step-by-step

Step 1: enable UFW

First, enable UFW on your Linux server (if not already enabled):

bash

sudo ufw enable

Check current status:

bash

sudo ufw status

Step 2: allow meshnet traffic on port 8123

The key command that makes Home Assistant accessible over Meshnet:

bash

sudo ufw allow in on nordlynx to any port 8123 proto tcp

This tells the firewall: “If traffic comes in via the NordVPN Meshnet interface (nordlynx) on TCP port 8123, allow it.”

Step 3: reload UFW

Apply the changes immediately:

bash

sudo ufw reload

Verify the rule was added:

bash

sudo ufw status numbered

You should see something like:

text

[ N] 8123/tcp on nordlynx  ALLOW       Anywhere

Step 4: grant meshnet local network access

This is the critical step that most guides miss. On your Linux server, run:

bash

nordvpn meshnet peer list

This will show all connected Meshnet peers. Find the device you’re connecting from (like the Meshnet device name shown in your NordVPN app).

Then allow that device to access local networks:

bash

nordvpn meshnet peer local allow <your-connecting-device-name>

For example:

bash

nordvpn meshnet peer local allow secret.cat-everest.nord

This is essential. Docker containers live on a bridge network, which Meshnet classifies as a “local network.” By default, Meshnet blocks peer access to local networks. This command explicitly grants permission.

If you want to allow all Meshnet peers (less secure, but simpler), you can run:

bash

nordvpn meshnet peer local allow all

Step 5: test the connection

From your client device, try accessing Home Assistant using the Meshnet device name:

bash

curl http://homeassistant-linux:8123

Or open a browser and navigate to:

text

http://homeassistant-linux:8123

Replace homeassistant-linux with whatever your actual Meshnet device name is.

It should work now. If it doesn’t, double-check that:

The device name in meshnet peer local allow matches exactly (case-sensitive)
UFW is allowing traffic on the nordlynx interface
Home Assistant is still running and listening on 8123

That’s all

Good luck and happy Zigbee’ing 🐝

Setup Apache Kafka in Docker on Windows

Marcin Zabłocki — Wed, 26 Apr 2017 22:00:00 +0000

This post describes how to quickly setup development environment for Apache Kafka in Docker on Windows. Apache Kafka is distributed streaming platform, which allows you to build reliable messaging channel between various systems. Its functionality supports publish/subscribe model, reliable message persistence, real-time stream processing and many more.

When I start learning any new technology, I want to get my hands drity as fast as possible, without spending too much time on environment setup. I wrote this post, to help you get started with Apache Kafka as fast as possible. In this post I cover full setup on Windows, but since it uses Docker, the process should be easily applicable for Linux/Mac machines. Besides Apache Kafka itself, the setup involves lauching Kafka-Manager UI (developed by Yahoo), so you will be able to manage your Kafka instance with ease. Let’s get started!

TL;DR

How to setup development environment for Apache Kafka + Kafka-Manager on Windows (using Docker).

Prerequisites

Docker installed (I use version 17.03.1-ce on Windows)
docker-compose installed (I use version 1.11.2)

Not required

knowledge of Docker
knowledge of Apache Kafka

Setup Apache Kafka with docker-compose

The setup will contain two containers:

Apache Kafka container (with Zookeeper built-in)
Kafka-Manger container

In order to join those two containers, we will use docker-compose. Create docker-compose.yml file and put the following content:

html

version: "2"

services:
  kafkaserver:
    image: "spotify/kafka:latest"
    container_name: kafka
    hostname: kafkaserver
    networks:
      - kafkanet
    ports:
      - 2181:2181
      - 9092:9092
    environment:
      ADVERTISED_HOST: kafkaserver
      ADVERTISED_PORT: 9092
  kafka_manager:
    image: "mzagar/kafka-manager-docker:1.3.3.4"
    container_name: kafkamanager
    networks:
      - kafkanet
    ports:
      - 9000:9000
    links:
      - kafkaserver
    environment:
      ZK_HOSTS: "kafkaserver:2181"

networks:
  kafkanet:
    driver: bridge

This docker-compose file decalres two mentioned containers. First one, kafkaserver runs Kafka image developed by Spotify team (it includes Zookeeper). It exposes itself under kafkaserver hostname in kafkanet network. Two environment variables need to be set:

ADVERTISED_HOST: kafkaserver
ADVERTISED_PORT: 9092

Those two describe to which hostname the Kafka server should respond from within the container.

Second container, kafka_manager runs newest (at the time of writing this post) kafka-manager tool. It needs to connect to the running Kafka server, that’s why there is the link entry in docker-compose:

html

links:
    - kafkaserver

Environment variable ZK_HOST also needs to be set in order to connect it to our Kafka server. We use hostname from kafkaserver container in order to achieve that.

Last thing in docker-compose file is network declaration, we use simple bridge networking there, so both containers can see one another.

Starting the environment

Once the docker-compose.yml file is ready, open your favorite terminal in the folder which contains it and run:

powershell

docker-compose up

After running this command, you can check status of the containers by invoking:

powershell

docker-compose ps

You should see output similar to this one:

Creating Kafka topic through Kafka-Manger UI

Now when the Kafka server is up and running, we can create a Kafka Topic. Topic in the Apache Kafka terminology is an isolated fragment to which multiple applications/systems can send messages and from which multiple consumers can receive (subscribe) data. One Kafka server can have any number of topics. I would say that Kafka Topic is equivalent of Table in SQL databases. It’s a separate category, isolated from the rest of the system.

Let’s launch Kafka-Manager, by opening

html

http://localhost:9000

in the browser:

Creating Kafka Cluster

As you can see, there are no Clusters yet (since it’s still an empty environment). Cluster is where Kafka stores all the data pushed to the topics. Let’s create one by using the Cluster menu:

For the quick setup, you can enter only:

Cluster Name - the name of your choice
Cluster Zookeeper Hosts - hostname of zookeeper (which is kafkaserver as configured in docker-compose.yml file)
Kafka Version 0.10.1.0 - which is the latest version at the time of writing this post

After entering those, click Save. You should be redirected to the homepage and see the cluster there:

Creating Kafka Topic

Now, when the cluster is present, navigate to it’s properties and open Create Topic from the menu:

Entering only Topic name is enough. Just hit Create from there. Done! Topic is created!

Testing Apache Kafka on Windows

It is done, environment is up and running. Let’s test it. The quickest way to do this is to use Apache-provided scripts and just launching two of them - one for the producer and one for the subscriber. In order to get those scripts, download the folowing file (it’s the actual Apache Kafka distribution, but we only need scripts from it):

html

https://www.apache.org/dyn/closer.cgi?path=/kafka/0.10.2.0/kafka_2.11-0.10.2.0.tgz

and extract it. Then follow the path to the following folder:

powershell

kafka_2.11-0.10.2.0.tgz\kafka_2.11-0.10.2.0.tar\kafka_2.11-0.10.2.0\bin\windows\

This folder contains bunch of script files:

powershell

Name
----
connect-distributed.bat
connect-standalone.bat
kafka-acls.bat
kafka-configs.bat
kafka-console-consumer.bat
kafka-console-producer.bat
(...)
zookeeper-server-start.bat
zookeeper-server-stop.bat
zookeeper-shell.bat

We are interested in kafka-console-consumer.bat and kafka-console-producer.bat, but before launching them, we need one more thing. In order to connect to Kafka in Docker from the Windows host, we need to map Kafka container hostname to the localhost, by editing hosts file:

powershell

C:\Windows\System32\drivers\etc\hosts

Append this line:
127.0.0.1 kafkaserver

Ok, let’s launch Kafka Consumer first:

powershell

K:\kafka_2.11-0.10.2.0\bin\windows> .\kafka-console-consumer.bat --bootstrap-server localhost:9092 --topic kafka_test
_topic

After launching this script, PowerShell window will hang, that’s a good thing. Open second terminal and launch Kafka Producer:

powershell

PS K:\kafka_2.11-0.10.2.0\bin\windows> .\kafka-console-producer.bat --broker-list localhost:9092 --topic kafka_test_topi
c

Type any message and hit ENTER, you should see the messages flowing, like this:

Stopping Apache Kafka docker

When the work is done, you can easily turn off running containers by invoking:

powershell

docker-compose down

in the folder when you have your docker-compose.yml file:

Summary

Now you have Apache Kafka with Kafka-Manger development environment up and running on your Windows machine. I hope that this short post helped you with the setup. Please share or leave a comment if you liked it!

Additional links & resources

full docker-compose.yml file used in this post: docker-compose.yml
Spotify Apache Kafka docker image: https://github.com/spotify/docker-kafka
Kafka-Manager docker image: https://hub.docker.com/r/mzagar/kafka-manager-docker/