Remote access to your JK BMS battery and DEYE inverter through your own router

Both devices — the JK BMS Web Gateway and the DEYE Web Gateway — serve their dashboard only inside your home network. This guide shows how to open it from your phone when you are away (at work, on holiday) without exposing anything to the internet. The procedure is the same for both devices; only the IP address differs. Nothing changes in the firmware.

⚠️ Never open (port-forward) the gateway's port 80 to the internet. The gateway has no HTTPS, anyone can read its data and only a PIN protects changes — it is deliberately a simple device for the local network. Anyone who found it on the internet would not only see the data but could also rewrite the battery's protection limits, change settings and wipe the WiFi. The only safe way is a VPN: from outside you connect into your home network, and then you see the gateway exactly as if you were at home.

What you'll need

A router with a VPN server. Most decent routers have one today: Mikrotik, Asus, Fritz!Box, Ubiquiti/Unifi, OpenWrt, TP-Link (Omada and newer home models), Synology. We recommend WireGuard — it is fast, simple, and a phone connects in a second. If your router only offers OpenVPN, use variant B in steps 3 and 4.
A public IP address on the router. Compare the "WAN IP" in the router's admin page with the address shown by e.g. whatismyip.com. If they match, you have a public IP. If the router shows something like 100.64.x.x or 10.x.x.x, you are behind your ISP's CGNAT — go straight to step 6.
The WireGuard app (or OpenVPN Connect) on your phone — both are free on the App Store and Google Play.

Steps

Give the gateway a fixed IP address (DHCP reservation)

In the router, open the list of connected devices, find the gateway (the JK BMS gateway announces itself as jkbms, the DEYE one as deye) and set a reservation for it, for example 192.168.0.5. The MAC address is also shown in the gateway dashboard header. Without a reservation the IP could change after a reboot and you would be guessing it from outside.

Enable DDNS if your public IP changes

Most home connections have a public IP that changes from time to time. So that the VPN on your phone always finds your router, enable the router's built-in DDNS client — the router then reports its current IP under a fixed name such as myhome.ddns.net. Services: no-ip.com (free, but a free hostname must be confirmed by e-mail every 30 days), DuckDNS (free, no confirmation) or the router vendor's own DDNS (Asus DDNS, MyFRITZ!, Mikrotik cloud, Synology QuickConnect/DDNS).

DDNS solves only how to reach the router from outside. By itself it opens and protects nothing — use it solely as the VPN address, never for forwarding a port to the gateway.

If your ISP gives you a static public IP, skip this step.

Enable the VPN server on the router

A — WireGuard (recommended)

In the router's admin page find VPN → WireGuard server (Asus: VPN → VPN Server → WireGuard; Fritz!Box: Internet → Permit Access → VPN (WireGuard); Mikrotik: WireGuard; OpenWrt: the luci-proto-wireguard package). Enable it and add one client (peer) for your phone. The router generates the keys itself and shows a QR code.

Check that the client is allowed to reach the home network (192.168.0.0/24, or whatever yours is) and that the endpoint is your DDNS name or static IP. The router opens one UDP port for the VPN by itself (typically 51820) — that is the only port that should be open from the internet.

B — OpenVPN

Where to find it: Asus VPN → VPN Server → OpenVPN; TP-Link Advanced → VPN Server → OpenVPN; Synology, the VPN Server → OpenVPN package; OpenWrt, the luci-app-openvpn package; Mikrotik PPP → OVPN Server (you have to create the certificates by hand there, which is for advanced users).

Enable the server and let the router generate a certificate. Keep the protocol UDP and the port 1194.
Set the client access to the home network (Asus: "Local network only" or "Both"; TP-Link: "Home Network Only"). Otherwise the VPN connects but you cannot see the gateway.
If the router asks for it, create a VPN user with a name and a strong password.
Export the .ovpn configuration file (the "Export" / "Export OpenVPN configuration file" button).
Open the file in a text editor and look at the remote line. It should hold your DDNS name from step 2, for example remote myhome.ddns.net 1194. TP-Link writes the current IP there and Synology the text YOUR_SERVER_IP — replace it.

Here too, this one port (UDP 1194) is the only one that should be open from the internet.

Connect the phone and open the dashboard

A — WireGuard: in the WireGuard app choose Add tunnel → Scan from QR code and scan the code from the router. Turn the tunnel on.

B — OpenVPN: get the .ovpn file onto your phone (e-mail it to yourself, use a cloud drive or a cable). In the OpenVPN Connect app choose Import Profile → File, pick the file, enter the VPN user's name and password and connect. The .ovpn file is a key to your home network — do not send it to anyone and delete it from your e-mail after the import.

Then open http://192.168.0.5 (your JK BMS gateway's IP) or your DEYE gateway's IP in the browser — the dashboard appears just like at home.

Tip: use the browser's Add to Home Screen so the dashboard sits as an icon next to your other apps.

The names jkbms.local and deye.local do not work over the VPN. They rely on mDNS, which does not pass through a VPN tunnel. From outside always use the IP address — which is why the reservation in step 1 matters.

Home Assistant works too

If you run Home Assistant at home with our integration, the Home Assistant app and all its dashboards work over the same VPN — for JK BMS and for DEYE alike. Nothing extra to set up.

Behind CGNAT, or your router has no VPN: Tailscale

Without a public IP a VPN on the router cannot work. The answer is Tailscale — a free VPN that needs neither a public IP nor any open port. Install it on something that is always on at home (in Home Assistant it is the Tailscale add-on; otherwise a Raspberry Pi or NAS) and enable its subnet router for your network 192.168.0.0/24. Install the Tailscale app on the phone, sign in with the same account, and open the dashboard on the same IP as at home.

What not to do

Port forwarding to the gateway (forwarding port 80 or any other port to the gateway's IP) — the dashboard and its settings would be open to the whole internet without a password.
DMZ on the gateway — the same, only with every port.
UPnP — turn it off on the router so that no other device opens ports on its own.
If you really need a public address without a VPN app, a reverse proxy with HTTPS and a password must sit in front of the gateway (for example the Nginx Proxy Manager add-on in Home Assistant). That is an advanced topic outside this guide — a VPN is simpler and safer.

Troubleshooting

The VPN connects but the dashboard does not load: check that the client is allowed to reach the whole home network in the router (not just "internet through VPN") and that you are using the IP address, not jkbms.local.
The VPN does not connect at all: verify the DDNS name (it must point at the router's current WAN IP) and that you are on mobile data, not on your home WiFi — many routers cannot connect to their own public IP from inside.
OpenVPN connects but the dashboard does not load: the server only allows clients "internet through VPN". Switch the access to the home network and export the .ovpn file again.
OpenVPN worked and stopped connecting after a while: the remote line of the .ovpn file holds an old public IP. Replace it with the DDNS name and import the profile again.
Works at home, not from outside, and the WAN IP is 100.64.x.x: you are behind CGNAT; use step 6 or ask your ISP for a public IP.