Keenetic WireGuard Remote Access: Browser RDP and SSH to the Whole LAN
Set up native WireGuard on a Keenetic router (KeeneticOS 3.3+) for ProxyLink: browser RDP, SSH and HTTP to every LAN device, no port forwarding, no static IP.
Keenetic routers are a common sight in European small businesses, branch offices, and the home-office sites that MSPs have to support. They are inexpensive, stable, and, since KeeneticOS 3.3, ship WireGuard as a built-in VPN type with no add-on packages. That makes a Keenetic a clean host for a ProxyLink tunnel: one outbound WireGuard connection gives your engineers browser-based RDP, SSH, VNC, and HTTP access to every device on the LAN, with nothing installed on the target machines and no inbound ports open on the site.
Why Keenetic suits outbound remote access
ProxyLink never asks the router to accept an inbound connection. The Keenetic initiates one WireGuard tunnel out to the ProxyLink relay, and the relay reaches back through that established tunnel to any device on the LAN. Because the connection is outbound, it does not matter whether the site has a dynamic WAN address or sits behind carrier-grade NAT (CGNAT), where the ISP shares one public address across many customers and no port forward is possible. Nothing is exposed on the WAN and there is nothing to forward. Keenetic's own site-to-site WireGuard guidance assumes one router has a reachable public IP; ProxyLink removes that requirement, because the router only ever dials out.
Create the tunnel in ProxyLink first
In ProxyLink, create a tunnel for the site and set its LAN subnet to match the Keenetic home segment, for example 192.168.1.0/24. ProxyLink assigns the router a peer address in the 10.100.0.0/16 range and shows you the relay public key and endpoint (46.225.153.241:51820). Keep that page open. You need those values on the Keenetic side, and you will paste the router public key back into it.
Configure WireGuard on the Keenetic
In the Keenetic web interface, go to Internet → Other connections and add a WireGuard connection. Keenetic generates a key pair for the connection. Copy the public key it shows and paste it into the ProxyLink tunnel so the relay accepts the peer, then set the connection's private IP address to the peer address ProxyLink assigned you in the 10.100.0.0/16 range. Now open the peer settings and fill in:
- Public key: the ProxyLink relay public key
- Endpoint:
46.225.153.241:51820, in IP:port form - Allowed IPs:
10.100.0.0/16, 10.128.0.0/9, so Keenetic routes relay-bound traffic back through the tunnel. This is exactly what ProxyLink writes into a generated config; the second range is the translated address space used when sites have overlapping LANs - Persistent keepalive: a low value such as
25seconds, so the outbound NAT session stays open and Keenetic re-establishes the handshake after a WAN reconnect or reboot. Keenetic defaults this field to 30
Save the connection. WireGuard uses UDP 51820 outbound by default. If you prefer, Keenetic lets you import a ready .conf file on the same page instead of typing each field, which fills them in automatically.
Reach the LAN and any extra VLANs
For the relay to reach devices behind the router, the Keenetic has to route between the tunnel and your local segment, so confirm the WireGuard connection is permitted to reach the home network in the router firewall. If the site has more than one internal network, for example a separate VLAN for cameras or voice, declare each of those subnets as an Additional Subnet on the ProxyLink tunnel and make sure the Keenetic routes them. ProxyLink then expands its server-side routing to include every declared subnet through the same single peer. One router, one tunnel, every segment reachable.
What your engineers actually reach
Once the tunnel is up, create a proxy link per device and service in ProxyLink. Everything opens in a browser, with nothing installed on the target or on the engineer's laptop:
- Windows PCs and servers (RDP on 3389), full browser RDP with no client on the engineer side
- Linux hosts and appliances (SSH on 22), a browser terminal, with optional per-link session recording on paid plans
- IP cameras, NVRs, and PBX admin panels (HTTP or HTTPS), opened straight in a browser
- Managed switches, printers, and the Keenetic web console itself, over an HTTP proxy link or browser SSH
Every session is written to the ProxyLink audit log: which engineer connected, to which IP and port, when, and for how long. The site keeps zero open inbound ports and needs no static IP.
Verifying the tunnel
On the Keenetic, the WireGuard connection should show as connected with a recent handshake and a non-zero transfer count. If the handshake never completes, confirm outbound UDP 51820 is not blocked upstream, check that the relay public key was pasted without a stray character, and confirm persistent keepalive is set. If the handshake succeeds but devices are unreachable, the missing piece is almost always the route or firewall permit from the tunnel to the LAN.
Why this holds up
ProxyLink is EU-hosted (Hetzner, Germany) and built on WireGuard, an open protocol, rather than a proprietary agent that phones home. Both TeamViewer and AnyDesk were breached in 2024, and a dark LAN with no inbound ports and no third-party agent on the target is a smaller attack surface by design. Access sits behind a ProxyLink login on top of the tunnel, and an MSP can keep each site as its own client group under one team.
Try ProxyLink free at app.proxylink.dev, no card required, free during early access. A Keenetic site takes about ten minutes to configure once the router is on WireGuard. Walkthroughs for Keenetic, MikroTik, pfSense, OPNsense, and OpenWrt are in the docs.