Digital Signage Remote Access for MSPs: Reach Media Players, Screens, and CMS Behind CGNAT
Remotely manage digital signage media players, displays, and CMS across LTE sites from a browser. One WireGuard tunnel per site, no port forwarding.
A digital signage estate is a fleet of small networks scattered across places you cannot drive to on a whim: a menu board wall in a quick-service restaurant, a window display in a retail unit, a wayfinding screen in a shopping centre, a video wall in a corporate lobby. Each site has a media player, one or more commercial displays, and often a small switch and a router, all reporting back to a content management system. When a screen freezes on a black frame, a player stops pulling the schedule, or a firmware push is needed before a campaign goes live, someone has to reach the hardware directly. Traditional remote access turns that into a site visit, because signage sites are almost never built to accept inbound connections.
Why Signage Sites Are Hard to Reach
Two things work against you. First, connectivity. Most signage locations run on whatever link is cheapest to install: a 4G or LTE router at a pop-up or a bus shelter, or a slice of the host site's broadband that you do not control. Cellular links sit behind carrier-grade NAT (CGNAT), so the router has no public IP and no port to forward. Host-site broadband is usually a dynamic address on a network the venue's own IT locks down. There is no static address to point a management tool at.
Second, the hardware. A BrightSign player, an Android system-on-chip player, an LG webOS or Samsung Tizen smart display, a commercial panel driven over its control port: these run embedded firmware. You cannot install a remote control agent on them. They expose a web UI, a diagnostic interface, or a TCP control protocol, and that is all you get. It is also all you should need.
Why Agents and Port Forwarding Both Fail Here
Agent-based remote support reaches a device only if that device can run the agent. On a signage network that covers almost nothing: the media players are embedded, the displays are appliances, and the network gear has no general-purpose software layer. Paying per device for the sliver of the estate an agent can touch, then keeping a second method for everything else, is exactly the overhead an MSP is trying to remove.
Port forwarding fails for a different reason. Exposing a player's diagnostic web server or a display's control port straight to the internet puts unattended hardware one weak default password away from a stranger, and signage control protocols rarely authenticate at all. On CGNAT or LTE there is no inbound address to forward to in the first place.
One Tunnel on the Site Router
ProxyLink reaches the whole site from a single outbound tunnel. You install one WireGuard tunnel on the site's router or gateway: a MikroTik, a Teltonika RUT on cellular, an OpenWRT box, or any Linux gateway. The router dials outbound to ProxyLink and holds the tunnel open with a persistent keepalive. Because the connection is initiated from the site, CGNAT, dynamic IPs, and ISP port blocks are all irrelevant. Nothing is installed on the players or the displays. From that point every IP on the site network is reachable, and the site keeps zero open inbound ports. A scan of the carrier's range finds nothing to connect to.
What You Actually Access
Once the tunnel is up, create a proxy link per device and service:
- Media player web and diagnostic UIs (port 80 or 443): an HTTP or HTTPS proxy link to a BrightSign Diagnostic Web Server or an Android player's admin page for firmware, storage checks, and schedule troubleshooting.
- Windows media players (port 3389): full browser RDP to a Windows-based player or on-site CMS box, with no client software on the engineer's laptop.
- Commercial display control (TCP link): a VPN-secured TCP proxy link to a panel's control port so a management tool can power screens on and off, switch inputs, or query status.
- On-site CMS and Linux players (port 22): a browser SSH terminal for diagnostics and log pulls, with session recording on paid plans.
All of it runs in a browser tab. There is no VPN client to install on the engineer's laptop and no per-site software to maintain.
Multi-Site Fleets
A signage operator or MSP rarely runs one screen. Group each location under its own client group, one tunnel per site, and scope engineers to the sites they cover. Many small sites reuse the same default LAN range, so several will land on 192.168.1.0/24. ProxyLink assigns each gateway tunnel a unique internal range and translates transparently, so two sites with identical addressing stay completely distinct with no renumbering. Every session is logged with engineer identity, target IP and port, timestamp, and duration, and WireGuard peer isolation is enforced at the kernel level so one site's tunnel can never reach another's.
Deployment
Budget around 15 minutes for the first tunnel. On MikroTik, ProxyLink's auto-configuration deploys the WireGuard config over SSH for you. After that, every player, display, and CMS box on the site is reachable from a browser with no agent to maintain and no open ports facing the internet. Setup guides for MikroTik, Teltonika, OpenWRT, and pfSense are in the docs.
Try ProxyLink free at app.proxylink.dev, no card required, free during early access. One tunnel per signage site, every screen and player reachable from a browser, no static IP and no port forwarding.