BMS Remote Access for MSPs: Reach BACnet Controllers, Niagara JACEs, and HVAC Web UIs Without Port Forwarding

A building management system is one of the least reachable networks an MSP or controls contractor gets asked to support. The plant sits in a basement or a rooftop riser: a Niagara supervisor or JACE controller, a handful of field controllers on BACnet, some Modbus meters, and a small router the building's own IT usually owns. When a schedule stops firing, a sensor reads wrong, or a firmware push is due before a season change, someone has to reach the hardware. Traditional remote access turns that into a drive across town, because BMS networks are almost never built to accept an inbound connection.

Why BMS Sites Are Hard to Reach

Two things work against you. First, connectivity. A building's controls network rides on whatever link was cheapest to install: a slice of the tenant's broadband on a dynamic address, or a 4G or LTE router at a site with no wired service. Cellular links sit behind carrier-grade NAT (CGNAT), so there is no public IP and no port to forward. Where there is broadband, the building's IT locks it down and will not hand you a static address or a forwarded port. There is nothing stable to point a management tool at.

Second, the hardware. A Tridium Niagara JACE, a Distech or Reliable Controls field controller, a Schneider or Honeywell BMS head end: these run embedded firmware. You cannot install a remote control agent on them, and doing so would usually void the support contract anyway. What you get is a local web UI, a BACnet/IP interface, and often a Modbus register map. That is all you get, and it is all you should need.

Why Agents and Port Forwarding Both Fail Here

Agent-based remote support only reaches a device that can run the agent. On a controls network that covers almost nothing: the controllers are appliances, the meters are fixed-function, and the router has no general-purpose software layer. Paying per device for the sliver an agent can touch, then keeping a second method for everything else, is exactly the overhead an MSP is trying to remove.

Port forwarding fails for a different reason. Exposing a controller's web UI or an open BACnet or Modbus port straight to the internet puts building plant one weak default password away from a stranger, and neither BACnet nor Modbus authenticates on its own. On CGNAT or a locked-down tenant line there is no inbound address to forward to in the first place.

One Tunnel on the Site Router

ProxyLink reaches the whole controls network from a single outbound tunnel. You install one WireGuard tunnel on the site's router or gateway: a MikroTik, an OpenWRT box, a pfSense or OPNsense firewall, or any Linux gateway. The router dials outbound to ProxyLink and holds the tunnel open with a persistent keepalive. Because the connection is initiated from the site, CGNAT, dynamic IPs, and ISP port blocks are all irrelevant. Nothing is installed on the controllers. Every IP on the controls VLAN becomes reachable, and the site keeps zero open inbound ports. A scan of the ISP range finds nothing to connect to.

What You Actually Access

Once the tunnel is up, create a proxy link per device and service:

• Niagara supervisor and JACE web UIs (HTTPS): an HTTPS proxy link to the station's web interface for point lists, schedules, alarms, and firmware. Niagara serves its browser UI over HTTP or HTTPS on the usual web ports, separate from its Fox service on TCP 1911, or 4911 for the TLS-secured Foxs.
• Field controller and head-end web UIs (HTTP or HTTPS): reach any controller's local configuration page on whatever port it listens on.
• BACnet/IP (UDP link to port 47808): a VPN-secured UDP proxy link so a BACnet client on your laptop can talk to a controller by unicast. Port 47808, hex 0xBAC0, is the IANA default for BACnet/IP. Note that BACnet's own device discovery relies on broadcasts, so network-wide Who-Is still needs a BBMD on site the same as any routed BACnet network; a directed link is for reading and writing a controller you already know.
• Modbus TCP meters (TCP link to port 502): poll live register data from energy meters and gateways.
• On-site Linux gateway (port 22): a browser SSH terminal for diagnostics, with session recording on paid plans.

All of it runs in a browser tab. There is no VPN client on the engineer's laptop and no per-site software to maintain.

Multi-Building Portfolios

A controls contractor rarely runs one building. Group each site under its own client group, one tunnel per building, and scope engineers to the sites they cover. Many small sites reuse the same default LAN range, so several will land on 192.168.1.0/24. ProxyLink assigns each gateway tunnel a unique internal range and translates transparently, so two buildings with identical addressing stay distinct with no renumbering. Every session is logged with engineer identity, target IP and port, timestamp, and duration, and WireGuard peer isolation is enforced at the kernel level so one building's tunnel can never reach another's.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. One tunnel per building, every controller reachable from a browser, no static IP and no port forwarding. Setup guides for MikroTik, pfSense, OPNsense, and OpenWRT are in the docs.