October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
Bettesworth Construction
Building Automation

How to Control IoT Devices Remotely and Locally: A Comprehensive Guide

A practical guide to local-first IoT control, secure remote access, Matter and MQTT setup, outage testing, and security hardening for homes and facilities.

By Bettesworth Construction Team 9 min read
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The most dependable approach is local-first control with secure remote access. Keep routine commands, device state, and automations on a local hub or controller, then reach that controller from outside the property through a VPN or trusted relay. Use a manufacturer’s cloud only when it provides a necessary function—such as remote video, notifications, voice assistants, firmware updates, or a device with no local interface.

This architecture suits smart homes, construction sites, offices, plant rooms, and small commercial facilities. It can control lights, plugs, thermostats, cameras, locks, sensors, pumps, appliances, and custom MQTT equipment while reducing dependence on a single vendor or internet connection.

As an Amazon Associate I earn from qualifying purchases.

Local and remote IoT control are different things

“Remote control” describes where the user is located. “Cloud control” describes the route a command takes. They are not the same.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Local control: A phone, hub, computer, or automation system communicates with a device over the property’s LAN or local radio network.
  • Remote control: The user is away from the property, using cellular data, another Wi-Fi network, or a remote office.
  • Cloud control: A manufacturer’s server receives the command and relays it to the device.
  • Remote local control: A VPN or secure relay connects the user to a local controller, which then operates devices locally.
  • Local automation: A rule such as “when motion is detected, switch on the light” runs on the site without an internet round trip.

A device may work locally while still needing the internet for account login, push notifications, cloud video storage, voice assistants, firmware updates, remote access, or recovery. Always test the exact functions you need rather than relying on the phrase “works without internet.”

#1 Best Overall
Kasa Smart Plug Ultra Mini 15A, EP10P2, Smart Home Wi-Fi Outlet
  • Voice control: Kasa smart plugs that work with Alexa and Google Home Assistant. Enjoy the hands free convenience of controlling any home electronic appliances with your voice via Amazon Alexa or Google Assistant
  • Easy set up and use: 2.4GHz Wi-Fi connection required. Plug in, open the Kase app, follow the simple instructions and enjoy
  • Scheduling: Use timer or countdown schedules set your smart plug to automatically turn on and off any home electronic appliances such as lamps, fan, humidifier, Christmas lights etc.
  • Smart Outlet Control from Anywhere: Turn electronics on and off from anywhere with your smartphone using the Kasa app, whether you are at home, in the office or on vacation.
  • Trusted and Reliable: Kasa is trusted by over 6 Million users and being the Reader’s Choice of PCMag 2020. UL certified for safety use. 2-year warranty.

Command paths at a glance

Local:  Phone or controller → LAN/radio → IoT device
Cloud:  Phone → manufacturer cloud → internet → IoT device
VPN:    Remote phone → encrypted VPN → local controller → IoT device
Relay:  Remote phone → trusted relay → local controller → IoT device

For heating, access control, pumps, alarms, and other consequential equipment, local operation and a physical fallback are especially important.

Identify the device’s control path first

Do not assume that a device advertised as “smart” supports local control. Before buying or configuring it, check:

  • Whether it has a documented LAN API or open protocol.
  • Whether its hub and automations continue working when the internet is disconnected.
  • Whether remote access requires a subscription.
  • Whether setup requires a vendor account.
  • Whether it supports Matter, HomeKit, MQTT, Zigbee, Z-Wave, REST, WebSocket, RTSP, ONVIF, or another documented interface.
  • Which features disappear when it is connected through a bridge or standardized interface.
Device type Typical local path Typical remote path Common limitation
Wi-Fi plug or bulb LAN API, Matter, Home Assistant Vendor cloud, VPN, controller relay Many low-cost products are cloud-dependent
Zigbee sensor or switch Zigbee coordinator and hub Remote access to the hub Requires a maintained radio mesh
Z-Wave device Z-Wave controller Remote access to the controller Radio frequencies vary by region
Matter device Matter controller over Wi-Fi, Ethernet, or Thread Ecosystem hub or remote controller Feature support differs by device
Bluetooth device Phone or Bluetooth gateway Cloud-connected gateway or controller Short range and gateway dependence
MQTT device Local MQTT broker VPN or secured remote broker Broker security is the operator’s responsibility
Camera RTSP, ONVIF, NVR, or local integration Vendor cloud, VPN, or secure relay Bandwidth, privacy, storage, and NAT issues
Industrial or custom equipment Ethernet, Modbus gateway, MQTT, REST, or OPC UA VPN, private APN, or industrial remote-access platform Safety, uptime, and change-control requirements

Four practical architectures

1. Manufacturer cloud

This is the easiest option: install the vendor app, create an account, pair the device, enable remote access if necessary, then test it over cellular data with property Wi-Fi disabled.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

It is suitable for beginners, cloud-dependent cameras, and devices without a local API. The trade-offs are vendor outages, changing subscriptions, account compromise, telemetry leaving the property, and possible loss of operation during an internet failure.

2. Local LAN control

A phone or controller communicates directly with a Wi-Fi or Ethernet device. This generally offers low latency and can continue during a WAN outage. However, discovery may fail across VLANs, a local API may be undocumented, and some products still require cloud authentication despite advertising local operation.

Rank #2
Sale
GHome Smart Plug, WiFi Smart Plugs that Work with Alexa and Google Home
  • Stability Upgrade Quick Connection:Supports Bluetooth or WiFi connection.The improved WiFi technology let you quick connection and stay stable,no disconnection worries. Please keep the smart plug connected to your stable 2.4GHz network.(Note: Only 2.4Ghz WiFi)
  • Hand-Free Voice Control:Smart plugs that work with Alexa and Googel Assistant. Just give a simple voice command to Alexa or Google Assistant to control your connected home devices. Enjoy the joy of smart home devices.
  • APP Remote Control From Anywhere:You also can control your outlet timers anywhere anytime via the APP directly when you are away. Monitor and control connected electrical equipment in your home.The smart outlet plug compatible with GHome APP, Smart Life App and Tuya App.
  • Schedules and Timer Function:Easy to set timers and add schedules to connected smart home devices circularly or randomly, making them work as scheduled like auto-off and auto-on to save energy and money. Such as lamps, fan, humidifier, Christmas light timers etc.
  • Group Control and Sharing:You can set a group for some wifi smart plugs and control connected appliances with one tap. Also you can share your wifi outlet plug by App with your families and enjoy the smart life together.

Use DHCP reservations or stable hostnames for important equipment. Never expose an unauthenticated local API beyond a trusted network.

3. A local hub or automation controller

A hub can connect Zigbee, Z-Wave, Thread, Bluetooth, Matter, Wi-Fi, and proprietary devices. This centralizes automations and backups and often improves battery life compared with Wi-Fi sensors.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The hub is also a single point of failure. Poor coordinator placement, radio interference, weak mesh routing, storage failure, or a hub replacement can interrupt the whole installation. Keep backups and document pairing information.

4. Remote access to the local controller

A VPN or trusted relay lets an authorized user reach a local controller from elsewhere. The command can then stay local between the controller and device. This gives a better balance of resilience, privacy, and convenience than exposing individual devices to the internet.

Home Assistant: a local-first example

Home Assistant can operate without its optional cloud service. Its local integrations can continue operating on the property, while Home Assistant Cloud adds remote access and integrations with Google Assistant and Amazon Alexa. Individual integrations may still depend on their manufacturers’ clouds.

Rank #3
Sale
GHome Smart Plug, WiFi Smart Plugs that Work with Alexa and Google Home
  • Stability Upgrade Quick Connection:Supports Bluetooth or WiFi connection.The improved WiFi technology let you quick connection and stay stable,no disconnection worries. Please keep the smart plug connected to your stable 2.4GHz network.(Note: Only 2.4Ghz WiFi)
  • Hand-Free Voice Control:Smart plugs that work with Alexa and Googel Assistant. Just give a simple voice command to Alexa or Google Assistant to control your connected home devices. Enjoy the joy of smart home devices.
  • APP Remote Control From Anywhere:You also can control your outlet timers anywhere anytime via the APP directly when you are away. Monitor and control connected electrical equipment in your home.The smart outlet plug compatible with GHome APP, Smart Life App and Tuya App.
  • Schedules and Timer Function:Easy to set timers and add schedules to connected smart home devices circularly or randomly, making them work as scheduled like auto-off and auto-on to save energy and money. Such as lamps, fan, humidifier, Christmas light timers etc.
  • Group Control and Sharing:You can set a group for some wifi smart plugs and control connected appliances with one tap. Also you can share your wifi outlet plug by App with your families and enjoy the smart life together.

Set up local control

  1. Install Home Assistant on supported hardware; Ethernet is preferable for the server.
  2. Give the server a DHCP reservation or stable local hostname.
  3. Add each device through the most local-capable option: native local integration, Matter, Zigbee, Z-Wave, MQTT, local vendor API, or a bridge.
  4. Assign clear names, rooms, areas, and device classes.
  5. Disable the internet connection while keeping the LAN powered, then test manual control and automations.
  6. Create a backup before enabling remote access.

For app setup, install the Home Assistant Companion App, choose Connect to my Home Assistant server, allow discovery, select the server, and sign in. If discovery fails, choose Enter address manually and enter the local URL.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Remote access with Home Assistant Cloud

  1. Confirm that local device control works first.
  2. Open Home Assistant’s Cloud settings and activate remote access.
  3. Confirm the generated remote URL.
  4. In the Companion App, choose Enter address manually if the server is not discovered.
  5. Sign in and test the dashboard over cellular data with home Wi-Fi disabled.
  6. Test notifications separately from dashboard control.
  7. Confirm that local automations still work when the external internet connection is interrupted.

This normally avoids opening an inbound router port, but the Home Assistant server and relay service must remain available. Do not give every remote user administrator privileges.

Remote access with a VPN

Install WireGuard or OpenVPN on a capable router or host, or use a mesh VPN such as Tailscale. Create individual identities, enable MFA where available, restrict access to the controller and required subnets, and revoke lost devices immediately.

Do not use an unsecured local HTTP address as the app’s external address when away from home. Home Assistant warns that credentials and commands can be exposed if a user forgets to activate the VPN. Use HTTPS or ensure the VPN is always active before sending credentials.

Matter, Zigbee, Z-Wave, Wi-Fi, and MQTT

Matter and Thread

Matter is an application-layer standard that runs over Wi-Fi, Ethernet, or Thread. It is not a replacement for those networks, and it still requires a Matter controller. Thread devices also require a Thread-capable border router. Google states that a Matter hub is required for setup, control, and automation while away from home; see its compatibility guidance.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Govee Smart Plug, WiFi Outlet Compatible with Alexa & Google Assts, 4 pcs
  • Stability Upgrade: Supports Bluetooth or WiFi connection, which is more stable and faster than plugs that can only be connected through WiFi. No disconnection worries, control all your home appliances and devices anytime & anywhere.
  • Smart Voice Control: WiFi Plugs Work with Amazon Alexa and Google Assistant, so you can control the smart home devices using simple voice commands. Free hands by using smart plugs and enjoy the funny interactive process. Note: Don't support 5G WiFi.
  • Scheduling & Group Controller: Create customized schedules to power your electronic appliances on/off automatically for helping save energy and money. And with a single tough of one button, you can manage multiple smart plugs simultaneously.
  • Multiple Safeguards & Small Size: With ETL & FCC certified, the quality of smart plug is assessed. Our product is rated: 10A, 1200W and support 120V. Compact and flexible design can save space, smart home plugs fit for every corner of your room.
  • Easy Install and Use: Download the Govee Home App and search for H5083, you can pair smart outlet successfully in minutes without barrier in smart home; share with your family on Govee app via phones so you can enjoy the smart life together.

Matter is designed for local control, but setup, firmware updates, remote access, voice assistants, and some manufacturer requirements may still use the internet. Matter’s multi-admin capability allows a device to be shared with more than one ecosystem. In Home Assistant, the documented path is Settings > Matter > Add device > Yes, it’s already in use, followed by the existing controller’s pairing instructions.

Choose one platform as the automation authority. Multiple ecosystems can create duplicate routines, conflicting commands, different feature names, and confusing ownership or fabric records. A native integration may expose more features than a Matter bridge.

Zigbee and Z-Wave

These are local radio networks managed by a coordinator or hub. They are attractive for battery sensors, switches, and devices where Wi-Fi congestion or battery life is a concern. Their limitations include radio interference, mesh maintenance, coordinator failure, and possible re-pairing during migration. A local radio link does not guarantee that the hub’s app, notifications, or remote access are cloud-free.

MQTT for custom and industrial devices

MQTT uses a broker to route messages between sensors, controllers, gateways, and software. An illustrative local command is:

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
mosquitto_pub 
  -h 192.168.1.20 -p 1883 
  -u mqtt_user -P 'REPLACE_WITH_PASSWORD' 
  -t 'home/living-room/light/set' 
  -m '{"state":"ON"}'

To observe state:

mosquitto_sub 
  -h 192.168.1.20 -p 1883 
  -u mqtt_user -P 'REPLACE_WITH_PASSWORD' 
  -t 'home/living-room/light/state' -v

Topic names and payloads must match the device. For traffic crossing an untrusted network, use TLS, typically on port 8883:

Best Value
Kasa Smart Plug Ultra Mini 15A, EP10P4, Smart Home Wi-Fi Outlet
  • Voice control: Kasa smart plugs that work with Alexa and Google Home Assistant. Enjoy the hands free convenience of controlling any home electronic appliances with your voice via Amazon Alexa or Google Assistant
  • Easy set up and use: 2.4GHz Wi-Fi connection required. Plug in, open the case app, follow the simple instructions and enjoy. Kasa app reqiured
  • Scheduling: Use timer or countdown schedules set your smart plug to automatically turn on and off any home electronic appliances such as lamps, fan, humidifier, Christmas lights etc.
  • Smart Outlet Control from Anywhere: Turn electronics on and off from anywhere with your smartphone using the Kasa app, whether you are at home, in the office or on vacation.
  • Trusted and Reliable: Kasa is trusted by over 6 Million users and being the Reader’s Choice of PCMag 2020. UL certified for safety use. 2-year warranty.
mosquitto_pub -h mqtt.example.net -p 8883 
  --cafile ca.crt --cert client.crt --key client.key 
  -u mqtt_user -P 'REPLACE_WITH_PASSWORD' 
  -t 'home/living-room/light/set' -m '{"state":"ON"}'

Mosquitto documentation explains that authentication choices must be explicitly configured in Mosquitto 2.0 and later and should be combined with topic-level access control. Give sensors read or publish permissions appropriate to their role; do not give every client permission to command locks, heaters, or switches. MQTT itself does not secure an installation automatically.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Secure the installation

  • Change default passwords and use unique vendor credentials.
  • Enable MFA on cloud accounts and remote gateways.
  • Patch routers, hubs, controllers, cameras, and devices.
  • Put lower-trust IoT equipment on a separate VLAN where practical.
  • Allow only the traffic required between the controller and IoT network.
  • Disable UPnP unless it is genuinely needed.
  • Prefer a VPN or trusted relay to raw port forwarding.
  • Use TLS, authentication, ACLs, rate limiting, and logging if public access is unavoidable.
  • Give each family member, employee, or contractor an individual account.
  • Protect cameras, microphones, locks, presence sensors, and energy data more strictly than ordinary lights.
  • Keep physical controls for lighting, heating, access, pumps, and safety equipment.

A VPN protects the remote connection; it does not repair weak device passwords, old firmware, excessive privileges, or insecure services inside the network. CISA’s hardening guidance recommends reducing externally exposed VPN services and using strong cryptography.

Test failures before relying on IoT control

Internet outage

Disconnect the WAN connection while keeping the LAN powered. Test manual control, local automations, dashboards, notifications, voice commands, and recovery. Local Matter, Zigbee, Z-Wave, or LAN integrations may continue; vendor-cloud devices may not. Remote access from outside will normally fail until connectivity returns.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Power failure

Use UPS protection for the router, controller, coordinator, switch, and other critical network equipment. Check whether devices restore their previous state or a safe default. Confirm that battery devices reconnect and that locks, garage doors, heaters, pumps, and alarms have manual fallbacks.

Wi-Fi, VLAN, or discovery failure

If an app works at home but cannot discover devices, check SSID isolation, firewall rules, mDNS across VLANs, DHCP reservations, and whether the phone and controller are on the intended network. Use explicit controller-to-IoT rules rather than unrestricted access to administrative systems.

Matter commissioning failure

  1. Update the controller and Companion App.
  2. Confirm Wi-Fi, Bluetooth, nearby-device, and location permissions.
  3. Verify that a Thread border router is available for Thread devices.
  4. Move the phone and device closer to the access point or border router.
  5. Try commissioning to one controller first, then share the device.
  6. Document existing pairing information before removing stale records.

Home Assistant documents an Android-specific case in which Wi-Fi SSID access restrictions and unsuitable location permissions can prevent commissioning while the app is in the background.

Cloud account loss or controller failure

Export configuration backups, record device identifiers and pairing codes, document network settings, and photograph wiring and labels. For radio systems, confirm whether the network can migrate to replacement hardware. Test restoration rather than assuming a backup is usable. Consider a UPS, watchdog monitoring, spare hardware, and storage protection for a controller used in a business or construction facility.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Which approach should you choose?

  • Beginner with a few cloud-dependent products: Use the manufacturer’s app, enable MFA, and understand the internet and subscription dependency.
  • Multi-brand household or facility: Use a local controller such as Home Assistant with native local integrations, Matter, Zigbee, or Z-Wave where suitable.
  • Privacy-focused user: Prefer local protocols, local camera storage, and VPN access; retain cloud features only where their benefits justify data leaving the property.
  • Technical or DIY user: Use MQTT for custom devices, but implement TLS, authentication, ACLs, monitoring, and backups.
  • Camera-heavy installation: Evaluate local RTSP/ONVIF/NVR support, storage, bandwidth, privacy, and secure remote viewing separately from ordinary device control.
  • Business or industrial deployment: Use documented protocols, individual accounts, change control, audit logs, UPS protection, tested recovery, and a remote-access design approved for the equipment’s risk level.

Products such as Aqara’s Hub M3 may suit an Aqara-focused installation and advertise local automations, while Google Home offers mainstream Matter and voice-assistant integration. Neither category should be treated as automatically cloud-free: verify the exact device, region, firmware, features, and remote-access requirements before purchase.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Site Office

Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.