Pharmacy Remote Access for MSPs: Reach the Dispensing Server, POS, Fridge Monitors, and Cameras Without Opening Ports

An independent pharmacy runs on a small, busy network that almost never has an engineer sitting next to it. The dispensing and management system, the point-of-sale tills, the label and bag printers, the monitored vaccine fridges, and the cameras over the controlled-drug safe are all on site, usually behind a consumer router with a dynamic IP. When the dispensing server will not come up before the first prescription of the day, a fridge alarm fires overnight, or a till drops off the network, someone on your team has to reach that site. This guide shows how to give your engineers browser access to every device in a pharmacy over one outbound tunnel, with no static IP, no open ports, and nothing installed on the machines themselves.

Why a pharmacy network is dangerous to expose

The heart of the pharmacy is its dispensing and management system, and a large share of independents still run it on-premise. PioneerRx, the most widely installed independent pharmacy platform in the US, is deployed on a local Windows server in the store, with its data held on that server and backed up off-site. Around it sit the POS tills, the label and token printers, the in-store cameras and NVR, the networked vaccine-fridge temperature loggers, and the switch and router that tie them together.

Almost none of these should ever answer an unsolicited connection from the public internet. Exposed RDP to a pharmacy server is the same door ransomware crews have walked through for years, and what it guards, patient medication histories and payment details, is exactly what they are after. The cold-chain monitors matter for a different reason: public-health guidance is that vaccine fridges be monitored continuously, with an alarm on any out-of-range reading. So they stay on the LAN with no route in, which leaves the MSP with the familiar bad choices. Forwarding 3389 publishes the exact service attackers scan for. A per-engineer client VPN is heavy to roll out across every branch and still has to route the right subnet at the far end.

One tunnel covers the whole pharmacy

ProxyLink works from the inside out. You install one WireGuard tunnel on the pharmacy's router or gateway: a MikroTik, a pfSense or OPNsense box, an OpenWrt or EdgeRouter, or any Linux host down to a Raspberry Pi. The tunnel dials outbound to ProxyLink and holds itself open with a keepalive, so the pharmacy never accepts an inbound connection, needs no static IP, and works fine behind the carrier-grade NAT most high-street broadband now uses. You declare the LAN, and any separate VLAN the cameras or fridge monitors sit on, as subnets on the tunnel, and every device on those networks becomes reachable with nothing installed on it.

The links you create

With the tunnel up, you create a proxy link per service:

• Dispensing and management server (RDP): a browser RDP session to the Windows server running PioneerRx or your pharmacy platform, with no RDP client to launch and port 3389 never exposed to the internet.
• POS and back office (RDP or HTTPS): browser RDP to the till controller or back-office PC, or an HTTPS link to the point-of-sale web console where the platform has one.
• Vaccine fridge and cold-chain monitors (HTTP/HTTPS): a link to the temperature logger's web UI to read the current reading and history and acknowledge an alarm from anywhere, without that device ever facing the internet.
• Cameras and NVR (HTTP/HTTPS or TCP): a link to the NVR or camera web UI watching the dispensary and the controlled-drug safe, or a TCP link to the stream where you need the native app.
• Switch, printers and router (HTTPS or SSH): HTTPS links to appliance web UIs, browser SSH to the switch, and the same tunnel reaches the label printers and the router itself.

ProxyLink's default appliance mode rewrites the Origin and Referer headers so a device's same-origin check accepts the proxied request, the same handling that makes Synology, UniFi, and pfSense UIs work through it. If a console rejects it, one toggle flips the link to app mode.

What this looks like for an MSP

You manage many pharmacies, so each one is a client group, your engineers are granted only the branches they look after, and peer isolation keeps every pharmacy's traffic separate at the network layer. An engineer opens ProxyLink, clicks the branch's dispensing server, and is on it in a browser tab with no VPN client to start. Every session is tied to an engineer identity, with the target IP, port, start time, and duration recorded, and access requires a ProxyLink login. SSH and RDP sessions can be recorded per link on paid plans when you want an audit trail of what ran on a pharmacy's server.

The dispensing server, the tills, and the fridge monitors keep zero open inbound ports and stay invisible to the internet scans ransomware relies on. Traffic runs over open WireGuard, with the relay hosted in the EU on German infrastructure and no third-party routing, which matters when those machines hold medication records and card data. One tunnel per branch replaces per-device port forwards and per-machine remote tools with one outbound link that covers the whole site.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. Setup guides for MikroTik, pfSense, OPNsense, and Linux gateways are in the docs.