Car Dealership Remote Access for MSPs: One Tunnel to the DMS, Cameras, Phones and Signage
Reach a car dealership's DMS server, service lane PCs, cameras, VoIP and signage from a browser through one WireGuard tunnel. No port forwarding, no static IP.
A car dealership is one of the messier networks an MSP has to support. A single rooftop can run a dealer management system (DMS) server, service lane PCs, a showroom full of digital signage, dozens of IP phones, a camera system covering the lot, guest WiFi, and the back-office machines that finance and parts depend on. Groups that own several rooftops multiply all of it by location. When something breaks on a Sunday, driving to the site is the last thing anyone wants, and the usual remote-access shortcuts (port forwarding on the site router, a static IP, an agent on every machine) are exactly what you should not be doing to a network that touches customer finance data.
Why a dealership is hard to reach remotely
Most rooftops sit behind a business cable or fibre line with a dynamic WAN address, and a growing number sit behind carrier-grade NAT (CGNAT), where the ISP shares one public address across many customers and no port forward is possible at all. Even where a static IP exists, opening 3389 or a camera port to the internet on a network that handles PII and finance paperwork is a finding waiting to happen. The DMS itself (CDK, Reynolds and Reynolds, Dealertrack and others) increasingly has a hosted piece, but the local server, the service lane devices, the phones, the NVR and the signage players all live on the LAN, and that LAN is what you cannot get to.
One outbound tunnel, no open ports
ProxyLink reverses the direction of the connection. Instead of the internet reaching in, the dealership router makes one outbound WireGuard connection to the ProxyLink relay, and the relay reaches back through that established tunnel to any device on the LAN. Because the connection is outbound, a dynamic WAN address does not matter, CGNAT does not matter, and there is nothing to forward. The site keeps zero open inbound ports. Any WireGuard-capable router or firewall can host the tunnel: MikroTik, pfSense, OPNsense, a UniFi gateway and others, so you rarely need to change hardware.
Set up the tunnel
In ProxyLink, create a tunnel for the rooftop and set its LAN subnet, for example 192.168.10.0/24. ProxyLink assigns the router a peer address in the 10.100.0.0/16 range and shows you the relay public key and endpoint (46.225.153.241:51820). On the router, add one WireGuard peer pointing at that endpoint with PersistentKeepalive set to 25 so the outbound session stays open, then paste the router public key back into ProxyLink. One peer per site is all you ever configure.
Every VLAN through the same peer
Dealerships are almost always segmented: sales on one VLAN, service on another, a voice VLAN for the phones, a camera VLAN for the NVR, and a walled-off guest network. You do not need a tunnel per VLAN. Declare each internal subnet as an Additional Subnet on the ProxyLink tunnel and the relay routes all of them through the single peer. One outbound connection covers the whole building, every segment, without touching the router WireGuard config again.
What your engineers actually reach
Once the tunnel is up, create a proxy link per device and service. Everything opens in a browser, with nothing installed on the target or on the engineer laptop:
- The DMS and back-office servers (RDP on 3389), full browser RDP for finance, parts and accounting workstations
- Linux and appliance hosts (SSH on 22), a browser terminal, with optional per-link session recording on paid plans
- The NVR and lot cameras (HTTP or HTTPS), live camera UIs opened straight in a browser
- The VoIP PBX and phone provisioning UI, plus the managed switch and WiFi controller web consoles
- Showroom and service-drive signage players, reachable to fix a frozen screen without a site visit
Multiple rooftops, one console
An MSP running an auto group can keep every rooftop as its own client group, one tunnel each, under a single team. Engineers see only the sites they are assigned to, and every session is written to the audit log: which engineer connected, to which IP and port, when, and for how long. That record matters on a network that carries customer PII and finance documents, and it is the kind of evidence an auditor or a manufacturer IT security programme will ask for.
Why this holds up
ProxyLink is EU-hosted (Hetzner, Germany) and built on WireGuard, an open protocol, rather than a proprietary agent that phones home. TeamViewer and AnyDesk were both breached in 2024; a dark LAN with no inbound ports and no third-party agent on the DMS server is a smaller target by design. Nothing on the dealership network listens to the internet, and access sits behind a ProxyLink login on top of the tunnel.
Try ProxyLink free at app.proxylink.dev, no card required, free during early access. A rooftop takes about ten minutes once the router is on WireGuard. Setup guides for MikroTik, pfSense, OPNsense, UniFi and more are in the docs.