Access NVR Cameras and PBX Systems Remotely — No Static IP, No Agent
How MSPs can remotely access hotel NVR cameras and PBX admin panels with no static IP, no open ports, and no software installed on the devices.
NVR cameras and PBX telephone systems are two of the most common devices MSPs need to access remotely — and two of the hardest to reach. They run embedded software that cannot be modified. They sit on VLANs isolated from the main network. And most sites where they are deployed have no static IP.
The traditional solution — static IP + port forwarding — has three problems: it costs money, it exposes the device directly to the internet, and it breaks every time the ISP rotates the address. This guide shows the alternative.
The Real Problem with NVR and PBX Remote Access
NVR systems (Hikvision, Dahua, Uniview) and PBX platforms (Matrix Comsec, Yeastar, Grandstream) all have web-based admin interfaces. The interface expects to be reached on an IP and port — usually port 80 or 443 for the web UI, plus additional ports for streaming protocols.
You cannot install a VPN client on an NVR. You cannot install anything on a PBX without voiding support contracts. The device is what it is.
What you can do is put a WireGuard tunnel on the router that serves the same LAN segment. The router speaks WireGuard. The NVR and PBX do not need to know anything about it.
Hotel Anna: A Real Example
A hotel in Greece with a MikroTik router, three VLANs: main LAN (192.168.1.0/24), PBX VLAN (192.168.10.0/24), and camera VLAN (192.168.20.0/24). No static IP. Dynamic DSL.
One WireGuard tunnel on the MikroTik, with all three subnets in AllowedIPs. Firewall and mangle rules for each VLAN. Result: the PBX admin panel (192.168.10.5:80) and the NVR web interface (192.168.20.10:80) are both accessible from a browser, from anywhere, with zero open ports exposed to the internet.
Camera live preview works for NVRs that serve video through their web UI over HTTP — most Hikvision, Dahua, and Uniview models do this out of the box. Raw RTSP streams on separate ports require a dedicated TCP proxy link pointed at the RTSP port.
The Security Difference
Port forwarding exposes the device to every scanner on the internet. Shodan indexes thousands of Hikvision and Dahua NVRs with default credentials. A WireGuard approach does the opposite: zero open ports on the client network. The router initiates an outbound connection to your relay server — no inbound attack surface.
Access to the NVR or PBX web UI requires:
- A valid ProxyLink account
- Permission to the specific device (team-level or individual access control)
- An active WireGuard tunnel on the router (if the router is offline, nothing works — intentional)
What the MSP Engineer Actually Does
Open a browser. Click the NVR in the device list. The web UI loads. No VPN client. No IP to remember. Works from any device on any network, including tablets and phones.
Session recordings and audit logs capture every access event — when the engineer connected, how long the session lasted, from which IP. For NIS2 compliance, this is the audit trail that proves access was controlled and monitored.
Setting This Up
In ProxyLink, an NVR or PBX is just a proxy link pointed at the device's IP and port. Create a link for 192.168.20.10:80, associate it with the tunnel on that router, and it appears as a URL. HTTP and HTTPS links proxy the full web interface, including embedded video streams on the NVR web UI. TCP links handle raw TCP protocols (RTSP on a fixed port, proprietary PBX protocols).
Get free access during Early Access — connect your first NVR or PBX site in under 30 minutes.