iDRAC, iLO and IPMI Remote Access for MSPs: Reach Server BMCs Without Exposing Them

Every rack of servers has a management network most people ignore until something breaks at 2am. Dell calls it iDRAC, HPE calls it iLO, Supermicro and Lenovo expose it as IPMI or the XClarity Controller. Under the branding it is the same thing: a baseboard management controller, a small dedicated chip with its own network port and its own lightweight operating system, bolted to the motherboard. It gives you power control, a virtual console, virtual media, BIOS and firmware settings, and hardware health, and it keeps working when the host is powered off, as long as the machine still has standby power.

The BMC is the one interface you most want during an outage and the one you can never install anything on. There is no agent to deploy and no RMM package to push. It runs closed firmware. That is why an MSP managing servers across client sites hits the same wall every time: how do you reach an iDRAC or iLO from your office when the whole point of a BMC is that it sits on an isolated network with no route to the internet?

Why BMCs are so hard to reach

Good practice puts every BMC on a dedicated management VLAN with no default route to the internet, reachable only from inside the network or through a bastion host. That isolation exists for a reason. BMCs run full remote-control firmware, they have had serious authentication and remote-code-execution vulnerabilities over the years, and a compromised BMC hands an attacker power control and console access to the host underneath it. Forwarding a port to one from the public internet is close to the worst thing you can do on a server network.

So the two usual remote-access answers both fail here. A port forward puts the most sensitive device on the network directly in front of every internet scanner. A per-engineer client VPN works, but it is heavy to roll out across dozens of client sites, and it still needs the management VLAN routed and firewalled correctly at the far end. Neither is a good fit for an MSP that just needs to open a browser and land on an iLO login page.

Reach the whole management VLAN through one tunnel

ProxyLink works from the other direction. You install one WireGuard tunnel on the site's router or gateway: a MikroTik, a pfSense or OPNsense box, or any Linux host including a Raspberry Pi. The tunnel dials outbound to ProxyLink and holds itself open with a keepalive, so the site never accepts an inbound connection and needs no static IP. Declare the management VLAN as an additional subnet on the tunnel and every BMC on it becomes reachable, with nothing installed on the BMCs themselves.

From there you create a proxy link per interface. For the web console, where you spend most of your time, create an HTTPS link to the BMC on port 443. That gives you the login page, hardware health, power control, BIOS and firmware settings, and the Redfish API, which current firmware serves over that same HTTPS port. ProxyLink's default appliance mode rewrites the Origin and Referer headers so the BMC's built-in CSRF check accepts the proxied request, the same handling that makes Synology, UniFi and pfSense web UIs work through it.

The interactive virtual console adds keyboard, video and mouse redirection, and in some firmware it uses ports of its own. Because the tunnel carries the entire management VLAN rather than a single port, those are reachable too: add a TCP link for each port the console needs. If you drive hardware from the command line with ipmitool or a monitor that speaks IPMI over LAN, that traffic runs on UDP port 623, so create a UDP link to the BMC for that port and point your tooling at the ProxyLink endpoint.

What this looks like for an MSP

One tunnel per client site covers the production LAN, the management VLAN, and any other segment you declare, all through the same peer. An engineer opens ProxyLink, clicks the server's iLO link, and is on the interface in a browser with no VPN client, no jump box to SSH through first, and no Java plugin on their laptop. Every session is tied to an engineer identity, with the target IP, port, start time and duration recorded, and access requires a ProxyLink login with two-factor authentication. The management network keeps zero open inbound ports and stays invisible to internet scans.

This is the kind of access that agent-based tools cannot give you, because a BMC is exactly the class of device with no agent path. RMM and endpoint remote-control products reach an operating system. A BMC is what you use when there is no operating system left to reach.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. Setup guides for MikroTik, pfSense, OPNsense and Linux gateways are in the docs.