Build a remotely manageable Android kiosk without opening inbound router ports
Kiosk Satellite turns a compatible Android device into a dedicated Home Assistant kiosk and includes an embedded Remote Admin interface for browser-based management. This guide starts with the Android installation, Home Assistant connection, Remote Administration configuration, and local verification. After the kiosk works correctly on the local network, we will connect its HTTP interface to a Localtonet HTTP tunnel for remote access. The result is a practical installation-first workflow that keeps troubleshooting clear and avoids exposing an unverified service.
What Kiosk Satellite provides
Kiosk Satellite is a free, open-source application designed to turn an Android device into a dedicated Home Assistant kiosk. Instead of treating the tablet as a general-purpose browser, the application provides a guided setup process and kiosk-focused controls. Its documented capabilities include dashboard selection, kiosk protections, screensavers, gestures, remote administration, and optional integration features for a more purpose-built Home Assistant display.
The feature relevant to this guide is Remote Administration. When enabled, Kiosk Satellite runs an embedded HTTP server on the device. Its default port is 2324, although the project documentation states that the port is configurable. The root path serves the Remote Admin web interface, while additional paths provide a REST API and a WebSocket for live state, events, and log tailing.
Remote Admin can mirror the application's settings, display a screenshot of the kiosk, provide logs and a web console, and export configuration backups. Because these functions can reveal operational information or change device behavior, Remote Admin should be treated as an administrative service rather than a public dashboard.
Prerequisites for the installation
Prepare the kiosk locally before configuring remote connectivity. The evidenced Android requirement is Android 7.0 or newer. You also need a Home Assistant instance that the tablet can reach over its current network and a Home Assistant long-lived access token for the setup process. Do not place that token in screenshots, shared notes, tunnel names, or public troubleshooting posts.
The Android device should have a stable connection to the same network from which you will perform the initial verification. You also need permission to install an APK from outside the default application store. Android describes this control differently across versions and device vendors, so follow the prompt or settings page shown by the device rather than relying on a guessed menu path.
Download the APK only from the project's official repository release page. Release contents and filenames can change, so this guide does not hardcode a package filename. Select the current release that you have reviewed and retain a record of the version installed on the tablet.
A long-lived Home Assistant access token is a credential. Use an appropriately scoped account and follow least-privilege practices supported by your Home Assistant deployment. Never place the token in a Localtonet device token field, a public URL, browser bookmark title, or article screenshot.
Install and configure Kiosk Satellite on Android
Download the current APK
Open the official Kiosk Satellite releases page and download the APK from the release you intend to install. Review the release information before deploying it to a dedicated kiosk.
Transfer the APK to the Android device
Download the file directly on the tablet or copy the downloaded APK to it using a method appropriate for your environment. Confirm that you are opening the expected file from the official release.
Allow installation from the selected source
When Android blocks the installation, permit installation from the application or file source you used. The exact wording and location vary by Android version and device manufacturer. Limit the permission to the necessary source, then remove it afterward if that matches your device-management policy.
Install and open Kiosk Satellite
Complete the Android package installation and launch the application. If Android presents security or permission prompts, read them in the context of the kiosk features you plan to use rather than granting unrelated access automatically.
Complete the guided setup wizard
Follow the five-stage wizard to connect to the reachable Home Assistant instance, provide the required long-lived access token, choose the dashboard, and approve only the Android permissions required by your selected capabilities. The wizard can also accept an optional Remote Admin password.
Finish the wizard and verify the basic kiosk experience before enabling internet access. Confirm that the expected Home Assistant dashboard loads, that navigation behaves as intended, and that the tablet remains reachable on the local network. If the dashboard does not work locally, adding a tunnel will not correct the underlying Home Assistant URL, token, Wi-Fi, or application configuration.
Enable and verify Remote Administration locally
Kiosk Satellite starts its embedded administration server only when Remote Administration is enabled and a remote password has been set. You can provide the password through the setup wizard. If the initial setup is already complete, the documented on-device route is to swipe from the left edge, open Settings, select Device, and then open Remote Administration.
Set a unique administrative password that is not reused for Home Assistant, Localtonet, email, or another device. Enabling the setting without establishing the required password is not sufficient to start the server.
Identify the tablet's current LAN IP address using its Android network information or your network administration tools. With the documented default port, open the following address from another device on the same network:
http://<device-ip>:2324
Replace <device-ip> with the tablet's actual local address. If you changed the Remote Admin port, use the configured value instead of 2324. Sign in with the Remote Admin password and verify that the interface loads. Check a low-risk function such as viewing device information, the current screenshot, or recent logs before proceeding.
Confirm that a second device can reach Remote Admin over the LAN before creating the Localtonet tunnel. If the local page is unavailable, check whether Remote Administration is enabled, whether a password is set, whether Kiosk Satellite is running, whether the IP address and configured port are correct, and whether local network policies permit the connection.
Understand what the Remote Admin service exposes
| Interface | Documented location | Purpose |
|---|---|---|
| Remote Admin web application | / |
Browser-based settings, screenshots, logs, console access, file functions, and configuration management. |
| REST API | /api/ |
Authenticated programmatic access to device information, settings, commands, screenshots, logs, and related administration functions. |
| Live WebSocket | /api/ws |
Live state, event delivery, and log tailing for the administration interface and compatible clients. |
| Health endpoint | /api/health |
Read-only hardware and uptime information. The project documents this as the one unauthenticated API endpoint. |
The unauthenticated health endpoint is especially important when evaluating exposure. Although it is read-only, it can return device identity, addresses, battery state, screen state, memory, storage, CPU information, temperature, and uptime information. Decide whether making that endpoint reachable through the same public origin is acceptable for your environment.
Kiosk Satellite documents its API tokens as stateless. Previously issued tokens remain valid until they expire even if the administration password changes. Treat every token, especially a long-lived automation token, like a password. If exposure is suspected, do not assume that changing only the password immediately invalidates every existing session.
Expose the verified HTTP service with Localtonet
Once Remote Admin works from another device on the LAN, you can use an HTTP tunnel with Localtonet. Our client establishes an outbound connection to a Localtonet relay server, so this workflow does not require inbound router port forwarding, firewall changes, a public IP address, or VPN setup. The tunnel provides a public URL while the selected Localtonet client device is connected and the tunnel is running.
Install and run our client on a device that can reach the tablet's LAN IP and Remote Admin port. This can be the tablet only if a suitable current Localtonet client is available for that deployment and has the necessary network reachability. Otherwise, run the client on another trusted machine on the same reachable network. Check the current product and dashboard for supported client options rather than assuming platform availability.
Install and run the Localtonet client
Set up our client on the trusted device that can already open the Kiosk Satellite Remote Admin address over the local network.
Select the authenticated device
In the Localtonet dashboard, select the device using its device-specific authentication token. Keep that token private and never copy it into public documentation, screenshots, or support messages.
Choose an available relay server
Select a currently available relay server or region from the dashboard. Availability can vary, so do not use a server code copied from an old tutorial.
Create the HTTP tunnel configuration
Choose an HTTP tunnel and set its local target to the tablet's reachable LAN IP address and the verified Remote Admin port. Use port 2324 only when Kiosk Satellite is still using that documented default.
Start the tunnel
Creating a tunnel does not start it. Use the Start button, then wait for the tunnel to run and use the assigned public HTTPS address.
Test and stop access when it is not needed
Test the public address from a network outside the kiosk LAN and authenticate with the Remote Admin password. Stop or delete the tunnel when remote administration is no longer required.
For current dashboard guidance, consult our Localtonet HTTP tunnel documentation. HTTP tunnels can use a generated subdomain, a selected subdomain where supported, or a custom domain. Exact domain and DNS requirements should always be checked against the current documentation before configuration.
Security practices for remote kiosk administration
Use a strong, unique Remote Admin password and avoid leaving the public tunnel active indefinitely when remote access is only needed for maintenance. Keep the Android device, Kiosk Satellite, Home Assistant, and the machine running our client updated according to your operational policy.
Configuration backups deserve special care because the documented full backup can contain every setting, including secrets, plus the page's local storage. Store downloaded backups in an access-controlled location and do not attach them to public issue reports without inspecting and sanitizing them.
Remote Admin also supports powerful operations such as settings changes, file access, screenshots, commands, and application logs. A public HTTPS address protects the transport to the tunnel edge, but it does not make weak application credentials safe. Kiosk Satellite's own password remains a critical access control. Consider whether exposing the complete administrative surface is appropriate under your organization's network and device-management policies.
Frequently asked questions
What Android version does Kiosk Satellite require?
The evidenced installation requirement is Android 7.0 or newer. Device-specific behavior can still vary because Android vendors customize permissions, background operation, and kiosk controls.
What is the default Kiosk Satellite Remote Admin address?
The documented default is http://<device-ip>:2324. Replace the placeholder with the tablet's LAN address. The port is configurable, so use the actual configured port if it has been changed.
Why does the Remote Admin page not load locally?
Confirm that Remote Administration is enabled and that a remote password is set, because both conditions are required for the embedded server to start. Also verify the tablet's current IP address, configured port, application state, Wi-Fi connectivity, and local network rules.
Does a Localtonet tunnel require router port forwarding?
No. Our client establishes an outbound connection to a Localtonet relay server. This provides the public URL without configuring inbound router port forwarding, firewall changes, a public IP address, or VPN setup.
Is the tunnel available after I create it?
Not automatically. Creating a tunnel does not mean it is running. You must start it, and it remains available only while the selected client device is connected and the tunnel is running.
Should I expose Kiosk Satellite before testing it on the LAN?
No. First verify the Home Assistant dashboard and Remote Admin interface locally. This separates application or network problems from tunnel configuration and prevents an incomplete administrative setup from being exposed.
Connect your verified kiosk with Localtonet
After Kiosk Satellite and Remote Admin work correctly on your local network, create an HTTP tunnel with Localtonet to reach the password-protected interface remotely without opening an inbound router port.
Get Started Free →
