IoT at Home: How to Access Your Sensors and Devices from the Internet Securely

Why Your IoT Devices Are Not Reachable from Outside

When an ESP32 reads a temperature sensor and publishes the value to an MQTT broker on your Raspberry Pi, everything works because both devices are on the same local network. They can reach each other freely. The moment you try to query that broker from outside your home from your phone on mobile data, from a script running in the cloud, from a remote dashboard you hit a wall.

Your home router assigns private IP addresses to all your devices and sits between them and the public internet. Nothing from outside can initiate a connection to a device inside your network unless port forwarding is configured. Even then, a large portion of home internet connections today are behind CGNAT, where the ISP places many customers behind a single shared public IP. On CGNAT, port forwarding on your router does nothing because there is no dedicated public IP to forward from.

The common workaround is to use a cloud MQTT broker like HiveMQ Cloud or CloudMQTT. That works, but it means your sensor data passes through a third-party server you do not control, you are subject to their pricing and rate limits, and your devices need internet access to publish anything at all. A Localtonet tunnel keeps the broker on your own hardware and gives it a public address without any of those trade-offs.

How MQTT Works

MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe messaging protocol designed for constrained devices and unreliable networks. It is the standard protocol for IoT communication.

The architecture has three roles. A broker is a server that receives all messages and routes them to interested clients. A publisher is a device that sends data a temperature sensor, a motion detector, an energy meter. A subscriber is anything that wants to receive that data a dashboard, a Home Assistant instance, a script, another device.

MQTT is built for exactly this kind of scenario: low-power devices on unreliable connections sending small payloads frequently. An ESP32 can publish a sensor reading, go back to deep sleep, and wake up to publish again the broker holds everything in between.

Install the Mosquitto MQTT Broker on Raspberry Pi

Mosquitto is the most widely used open-source MQTT broker. It runs well on a Raspberry Pi and is available in the default package repositories on Raspberry Pi OS (Debian-based).

sudo apt update
sudo apt install -y mosquitto mosquitto-clients

sudo systemctl enable mosquitto
sudo systemctl start mosquitto

sudo mosquitto_passwd -c /etc/mosquitto/passwd myuser

Enter and confirm a strong password when prompted.

sudo nano /etc/mosquitto/conf.d/local.conf

Add the following content:

listener 1883
allow_anonymous false
password_file /etc/mosquitto/passwd

sudo systemctl restart mosquitto
sudo systemctl status mosquitto

Test locally with the Mosquitto client tools:

# Subscribe to a test topic in one terminal
mosquitto_sub -h localhost -p 1883 -u myuser -P yourpassword -t home/test

# Publish a test message from another terminal
mosquitto_pub -h localhost -p 1883 -u myuser -P yourpassword -t home/test -m "hello"

If the subscriber terminal shows hello, your broker is working correctly on the local network.

Expose Your MQTT Broker from Anywhere with Localtonet

Mosquitto listens on TCP port 1883. To reach it from outside your network, create a Localtonet TCP tunnel for that port. The tunnel opens an outbound connection from your Raspberry Pi to the Localtonet relay, which becomes the public address that remote devices and clients connect to.

curl -fsSL https://localtonet.com/install.sh | sh
localtonet --authtoken <YOUR_TOKEN>

# From any machine outside your home network
mosquitto_sub -h example.localto.net -p 33445 -u myuser -P yourpassword -t home/test

sudo localtonet --install-service --authtoken <YOUR_TOKEN>
sudo localtonet --start-service --authtoken <YOUR_TOKEN>

Connect an ESP32 to Your Remote MQTT Broker

With the tunnel running, any ESP32 or ESP8266 with internet access can publish sensor data to your home broker using the relay address as the host. The code is identical to a local connection only the host and port change.

// Arduino / ESP32 sketch
#include <WiFi.h>
#include <PubSubClient.h>

const char* ssid       = "YOUR_WIFI_SSID";
const char* password   = "YOUR_WIFI_PASSWORD";

// Localtonet relay address and port
const char* mqttHost   = "example.localto.net";
const int   mqttPort   = 33445;
const char* mqttUser   = "myuser";
const char* mqttPass   = "yourpassword";

WiFiClient   espClient;
PubSubClient client(espClient);

void setup() {
    Serial.begin(115200);
    WiFi.begin(ssid, password);
    while (WiFi.status() != WL_CONNECTED) { delay(500); }

    client.setServer(mqttHost, mqttPort);
}

void loop() {
    if (!client.connected()) {
        client.connect("esp32-sensor", mqttUser, mqttPass);
    }
    client.loop();

    float temperature = 22.4; // replace with real sensor read
    char payload[32];
    snprintf(payload, sizeof(payload), "{\"temp\": %.1f}", temperature);

    client.publish("home/living-room/temperature", payload);
    delay(30000); // publish every 30 seconds
}

HTTP-Based Sensor APIs

Not all IoT devices use MQTT. Some devices expose a simple HTTP API a small web server running on the device itself that you query with a GET request to read sensor values. Shelly smart plugs, Tasmota-flashed devices, and many DIY ESP32 projects work this way.

For these devices, the approach is the same but uses an HTTP tunnel instead of a TCP tunnel. The device runs a web server on a local port, and a Localtonet HTTP tunnel gives that port a public HTTPS URL.

# Read sensor data from a Tasmota or custom ESP32 device
curl https://abc123.localto.net/cm?cmnd=Status%2010

# Or a custom ESP32 API endpoint
curl https://abc123.localto.net/sensor

Security for Remote IoT Access

Frequently Asked Questions