How to use Deye-HomeMonitor away from home over a VPN

Deye-HomeMonitor reads data straight from the inverter's Wi-Fi logger in your home network – no cloud and no manufacturer account. Away from home (at work, on holiday) the app therefore cannot see the logger. This guide shows how to reach it safely through a VPN on your own router: first WireGuard, then OpenVPN. Nothing changes in the app or in the inverter.

⚠️ Never forward the logger's ports 80, 8899 or 502 to the internet. The logger's web page is not encrypted and ships with the password admin/admin. Port 8899 (Modbus) has no login at all – anyone who finds it on the internet can not only read the inverter but also write to its settings. Deye-HomeMonitor itself only reads; somebody else's program may not. The only safe way is a VPN: you connect from outside into your home network and then see the logger exactly as if you were at home.

What you need

A router with a VPN server. Most better routers have one: Asus, Fritz!Box, Mikrotik, Ubiquiti/UniFi, OpenWrt, TP-Link (Omada and newer home models), Synology. We recommend WireGuard – it is fast, simple and a phone connects in a second. If your router only offers OpenVPN, use variant B in steps 3 and 4; it works just as well, it only takes a little longer to connect.
A public IP address on the router. Compare the "WAN IP" in the router's admin page with the address shown by e.g. whatismyip.com. If they match, you have a public IP. If the router shows something like 100.64.x.x or 10.x.x.x, you are behind your provider's CGNAT – go to step 6.
A VPN app on the device that runs Deye-HomeMonitor: WireGuard or OpenVPN Connect. Both are free for Android and Windows.

In the examples below the home network is 192.168.1.0/24 and the logger is at 192.168.1.50. Replace them with your own values.

Steps

Give the logger a fixed IP address (DHCP reservation)

Open the list of connected devices in your router, find the inverter's logger and reserve an address for it, for example 192.168.1.50. Without a reservation the IP may change after a router restart and the app will not find the logger from outside.

Keep the same address in the app under Settings → Connection → Logger IP address / host. If you do not know it yet, the Find logger button finds it while you are at home.

Turn on DDNS if your public IP changes

Most home connections have a public IP that changes now and then. So that the VPN always finds your router, turn on its built-in DDNS client – the router then reports its current IP under a fixed name such as myhome.ddns.net. Services: DuckDNS (free), no-ip.com (free, the hostname must be confirmed by e-mail every 30 days) or the DDNS of the router's manufacturer (Asus DDNS, MyFRITZ!, Mikrotik Cloud, Synology DDNS).

DDNS only solves how to reach the router from outside. It opens and protects nothing – use it purely as the address for the VPN. If your provider gives you a static public IP, skip this step.

Turn on the VPN server on the router

A – WireGuard (recommended)

You will typically find it here:

Asus: VPN → VPN Server → WireGuard
Fritz!Box: Internet → Permit Access → VPN (WireGuard)
Mikrotik (RouterOS 7): WireGuard
UniFi: Settings → VPN → VPN Server → WireGuard
TP-Link: Advanced → VPN Server → WireGuard (newer models)
OpenWrt: package luci-proto-wireguard

Enable the server and add a client (peer) – a separate one for each device (phone, laptop), so that a lost device can be revoked on its own. The router generates the keys and offers a QR code (for a phone) and a .conf configuration file (for Windows). The client configuration looks like this:

[Interface]
PrivateKey = (the device's private key)
Address = 10.6.0.2/32

[Peer]
PublicKey = (the router's public key)
Endpoint = myhome.ddns.net:51820
AllowedIPs = 192.168.1.0/24
PersistentKeepalive = 25

Endpoint – your DDNS name from step 2 (or static IP) and the server port. Some routers put the current IP here – replace it with the DDNS name.
AllowedIPs – what goes through the tunnel. With your home network range (192.168.1.0/24) only traffic to your home uses the VPN and the rest of the internet works as usual. The value 0.0.0.0/0 sends everything through your home – that works too, just slower.
PersistentKeepalive = 25 – keeps the connection alive on mobile data.

The router opens one UDP port for the VPN (typically 51820). It is the only port that should be open from the internet.

B – OpenVPN

You will typically find it here:

Asus: VPN → VPN Server → OpenVPN
TP-Link: Advanced → VPN Server → OpenVPN
Synology: VPN Server package → OpenVPN
OpenWrt: package luci-app-openvpn
Mikrotik: PPP → OVPN Server (certificates must be created by hand – for advanced users)

Enable the server and let the router generate a certificate. Keep the protocol UDP, port 1194.
Set client access to the home network (Asus: "Local network only" or "Both"; TP-Link: "Home Network Only"). Otherwise the VPN connects but you will not see the logger.
If the router offers it, create a VPN user with a name and a strong password.
Export the .ovpn configuration file ("Export" / "Export OpenVPN configuration file").

Open the file in a text editor and check these lines:

client
dev tun
proto udp
remote myhome.ddns.net 1194
auth-user-pass

remote – must contain your DDNS name from step 2. TP-Link puts the current IP there and Synology the text YOUR_SERVER_IP – replace it.
auth-user-pass – you enter the VPN user's name and password when connecting.
With OpenVPN it is the server (the "home network" option above) that decides what goes through the tunnel, not the file on the device.

Only this one port (UDP 1194) should be open from the internet. If some network (hotel, office) blocks UDP, switch the server to TCP and export the .ovpn file again.

Connect your phone, tablet or computer

A – WireGuard

Android: in the WireGuard app tap + → Scan from QR code, scan the code from the router and switch the tunnel on.
Windows: install WireGuard from wireguard.com, choose Import tunnel(s) from file, pick the .conf file from the router and click Activate.

B – OpenVPN

Android: get the .ovpn file onto the phone (by cable or through your own cloud). In the OpenVPN Connect app choose Import Profile → Upload File, pick the file, enter the VPN user's name and password and connect.
Windows: in OpenVPN Connect likewise Import Profile → Upload File.

The .conf and .ovpn files are the key to your home network – never send them to anyone, and after importing delete them from e-mail and from your downloads.

Open Deye-HomeMonitor

Test it on mobile data (not on your home Wi-Fi): switch the VPN on and open the app. The dashboard goes Online just as at home – with the same logger IP address, nothing needs to be changed.

The weather forecast, electricity prices, licence check and updates use the internet and work with the VPN on or off.

The "Find logger" button will not find the logger over a VPN. It scans the network the device is currently in, and over a VPN that is a different network from your home one. From outside always use the IP address entered in Settings – another reason why the reservation from step 1 matters.

Behind CGNAT, or a router without VPN: Tailscale

Without a public IP a VPN server on the router does not work. The answer is Tailscale – a VPN built on WireGuard, free for personal use, that needs neither a public IP nor an open port. Install it on something that is always on at home (Raspberry Pi, NAS, home server), enable a subnet router on it for your network 192.168.1.0/24 and approve the route in the Tailscale admin console. Sign in to Tailscale with the same account on your phone or computer – Deye-HomeMonitor then works with the same logger IP as at home.

What not to do

Port forwarding to the logger (forwarding port 80, 8899, 502 or any other to the logger's IP) – the inverter would be reachable by the whole internet.
DMZ to the logger – the same, with all ports at once.
UPnP – turn it off on the router so that no other device opens ports by itself.
Do not leave the factory password admin/admin on the logger. Change it on the logger's web page and enter the new one in the app under Settings → Connection.

Troubleshooting

The VPN is connected but the app is Offline: check that the client is allowed into the home network (WireGuard: AllowedIPs; OpenVPN: "Home network" on the server) and that the logger IP in Settings is correct.
Works on mobile data but not on someone else's Wi-Fi: that network probably uses the same range as your home one (e.g. both 192.168.1.x) and the device looks for the logger there. Changing your home network to a less common range, such as 192.168.57.x, helps.
The VPN does not connect at all: check that the DDNS name points to the router's current WAN IP, and test from mobile data – from the home Wi-Fi many routers cannot connect to their own public IP.
Works at home, not from outside, and the WAN IP is 100.64.x.x: you are behind CGNAT – use step 6 or ask your provider for a public IP.
Android drops the VPN after a while: turn off battery optimisation for the VPN app (Settings → Apps → WireGuard / OpenVPN → Battery → Unrestricted).

Menu names in routers differ by model and firmware version – treat them as a guide. WireGuard, OpenVPN and Tailscale are trademarks of their respective owners.