Access Control and Door Entry Remote Access: No Port Forwarding, No Truck Rolls

Access control and door entry systems have quietly become IP devices. The door controller, the video intercom, the reader panel, and the management software all sit on a LAN and speak HTTP, and increasingly they live on sites nobody staffs: a gated car park, a storage yard, a block of flats, a remote depot. When a tenant code stops working or a door needs releasing, the installer or the MSP that inherited the account has two bad options: drive to site, or leave an inbound port open to the internet. ProxyLink removes both.

Why remote access to these sites is hard

Most access control gear was designed to be configured on site. The web admin panel listens on the LAN, the management software often runs on a small Windows box in a comms cupboard, and neither was meant to be reachable from the internet. Two things then get in the way. First, many of these sites sit on cellular routers or consumer broadband behind carrier-grade NAT (CGNAT), where the ISP shares one public address across many customers, so there is no static IP and no port to forward. Second, forwarding a port to a door controller's web interface is a genuinely bad idea: it publishes the one device that unlocks the building to every scanner on the internet.

ProxyLink turns the connection around

ProxyLink never asks the site to accept an inbound connection. A single WireGuard tunnel initiates outbound from the site to the ProxyLink relay, and the relay reaches back through that established tunnel to any device on the LAN. Because the tunnel dials out, CGNAT and dynamic IPs are irrelevant, and nothing is exposed on the WAN. There is no port forward to attack because there is no open port at all.

You put that tunnel in one of two places. If the site has a capable router or firewall (MikroTik, pfSense, OPNsense, OpenWrt, and Teltonika all support a WireGuard client that dials an external peer), the tunnel lives on the router and one connection covers the whole LAN. If the router cannot host it, or the access system runs its own Windows management server, run the ProxyLink one-liner on that Windows box:

irm https://app.proxylink.dev/deploy/{token} | iex

The script installs WireGuard, brings the tunnel up outbound, and self-registers the machine. Either way, the site ends up dark: no inbound ports, no static IP required.

One tunnel, every device and VLAN

Access systems are frequently isolated on their own VLAN, kept apart from the office network for security. ProxyLink handles that directly. Declare each VLAN subnet as an Additional Subnet on the tunnel, and the single peer reaches all of them. One tunnel gives you the door controllers on the security VLAN, the management server, and the cameras next to them, without a separate connection for each segment.

What the engineer actually opens

Once the tunnel is up, you create a proxy link per device and service. Everything opens in a browser, with nothing installed on the target or on the engineer's laptop:

• Door controller and intercom web admin panels over an HTTP or HTTPS proxy link
• The Windows management server over browser RDP, with no RDP client on the engineer side
• Linux-based controllers and appliances over a browser SSH terminal
• The site cameras or NVR that usually share the same rack, opened straight in the browser

A tenant lockout that used to mean a two-hour round trip becomes a link click. So does a firmware check, a schedule change, or pulling an event log after an incident.

Built for the audience that audits it

Access control is a security function, so the remote path into it has to be defensible. ProxyLink is EU-hosted (Hetzner, Germany) and built on WireGuard, an open protocol, rather than a proprietary agent that phones home. Both TeamViewer and AnyDesk were breached in 2024. Access sits behind a ProxyLink login on top of the tunnel, every connection is written to the audit log (which engineer, which device, when, and for how long), and session recording can be enabled per link for RDP, SSH, and VNC. For an MSP, each site can be kept as its own client group under one team.

Try ProxyLink free at app.proxylink.dev, no card required and free during early access. A site takes about ten minutes once the tunnel host is on WireGuard. Setup walkthroughs for MikroTik, pfSense, OPNsense, OpenWrt, and the Windows deploy are in the docs.