IPFire WireGuard Remote Access: Browser RDP and SSH to Your Entire LAN
Set up a ProxyLink WireGuard tunnel on IPFire (native since Core Update 195) for browser RDP, SSH and HTTP to every LAN device. No port forwarding.
IPFire is a hardened open-source firewall distribution that MSPs and IT teams deploy at branch offices, small businesses, and sites where a commercial appliance is overkill. As of IPFire 2.29 Core Update 195, released in June 2025, WireGuard is built into the core system with a native web interface, with no add-on package required. That makes an IPFire box a clean ProxyLink tunnel host: one outbound WireGuard connection covers every device behind the firewall, with nothing installed on the individual machines.
Why IPFire Works for Outbound Remote Access
ProxyLink never asks the firewall to accept an inbound connection. The IPFire box initiates a WireGuard tunnel out to the ProxyLink relay, and the relay reaches back through that established tunnel to any device on the LAN. Nothing is exposed on the WAN interface (IPFire's Red zone), there are no port forwards to maintain, and a dynamic or CGNAT WAN address does not matter. IPFire behind carrier-grade NAT connecting net-to-net to an external host is a documented WireGuard scenario, and it is exactly how ProxyLink operates.
Create the Tunnel in ProxyLink
In ProxyLink, create a new tunnel for the site and name it after the location. Set the LAN subnet to match IPFire's internal network, the Green zone, for example 192.168.1.0/24. ProxyLink assigns the IPFire peer an address in the 10.100.0.0/16 range and shows you the relay's public key and endpoint (46.225.153.241:51820). Keep that page open, you need those two values for the IPFire side.
Configuring WireGuard on IPFire
Open the WireGuard page in the IPFire web console. IPFire supports two connection types: host-to-net for individual roadwarrior clients, and net-to-net for joining two networks. For ProxyLink, use a net-to-net connection. Generate the keypair for the connection in the IPFire interface, then configure the peer:
- Remote endpoint: the ProxyLink relay,
46.225.153.241:51820 - Remote public key: the relay public key shown in ProxyLink
- Local subnet: your IPFire LAN, for example
192.168.1.0/24 - Remote subnet: the ProxyLink range
10.100.0.0/16, so IPFire routes relay-bound return traffic back through the tunnel - Persistent keepalive:
25, mandatory here so the NAT session stays open and IPFire re-initiates the handshake after a reboot or WAN reconnect
Copy the public key IPFire generated for this connection and paste it into the ProxyLink tunnel so the relay accepts the peer. WireGuard listens on UDP 51820 by default. One constraint to watch: IPFire requires the WireGuard address range not to overlap any existing OpenVPN or IPsec pool already configured on the box.
Firewall Rules
IPFire is default-deny between zones, and its WireGuard implementation is integrated with the firewall and connection tracking. After the tunnel is up, add a firewall rule permitting traffic from the WireGuard tunnel to the Green network so the relay can reach LAN devices. Return traffic on established connections is handled by connection tracking. Without that accept rule the handshake completes but the relay cannot reach anything behind the firewall, which is the most common cause of a tunnel that looks up but serves nothing.
Multiple Subnets and VLANs
If the site has more than one internal network, IPFire's Blue (wireless) or Orange (DMZ) zones, or tagged VLAN interfaces, add each subnet as a local subnet on the IPFire connection and as an Additional Subnet on the ProxyLink tunnel. ProxyLink expands its server-side routing to include every declared subnet through the same peer. One firewall, one tunnel, every subnet reachable.
What Engineers Access
Once the tunnel is up, create a proxy link per device and service in ProxyLink:
- Windows PCs and servers (port 3389), browser RDP with no mstsc.exe or VPN client on the engineer's laptop
- Linux hosts (port 22), browser SSH terminal, with optional session recording on paid plans
- IP cameras, NVRs, and PBX admin panels (port 80 or 443), HTTP or HTTPS proxy links opened straight in a browser
- Managed switches, printers, and the IPFire web console itself, HTTP proxy or browser SSH, with no driver or client install
Every session records who connected, to which IP and port, when, and for how long, in the ProxyLink audit log. RDP and SSH sessions can be recorded per link on paid plans. The site keeps zero open inbound ports and needs no static IP.
Verifying the Tunnel
On the IPFire WireGuard page, the connection should show as connected with a recent handshake and a non-zero transfer count. If the handshake never completes, confirm outbound UDP 51820 is not blocked upstream, check that the relay public key was pasted without a stray character, and confirm PersistentKeepalive is set. If the handshake succeeds but devices are unreachable, the firewall rule from the tunnel to Green is almost always the missing piece.
Try ProxyLink free at app.proxylink.dev, no card required, free during early access. An IPFire site takes about ten minutes to configure. Walkthroughs for IPFire, pfSense, OPNsense, MikroTik, and OpenWrt are in the docs.