School IT Remote Access for MSPs: MIS Servers, Whiteboards, CCTV, and Switches Without Port Forwarding

Schools are a deceptively complex MSP environment. A single secondary school or a multi-academy trust runs a management information system on a Windows server, a domain controller and file store, interactive whiteboards in every classroom, safeguarding CCTV, a VoIP phone system, cashless catering and door entry, all tied together by a managed switch and Wi-Fi fabric. Most of that equipment cannot run a remote access agent, and most schools sit on budget broadband with no static IP and, increasingly, carrier-grade NAT (CGNAT) that rules out port forwarding entirely. When a server falls over at 6am before staff arrive, the MSP needs a way in that does not depend on driving to site.

What a School Network Actually Contains

A typical school or academy site runs:

MIS and server estate, the management information system (SIMS, Arbor, Bromcom, or PowerSchool), a domain controller, and a file server. Windows, reached over RDP.
Interactive whiteboards and projectors, Promethean, SMART, or ViewSonic panels with embedded web interfaces for firmware and configuration. No agent path.
Safeguarding CCTV, an NVR and IP cameras (Hikvision, Dahua, Uniview) on an isolated VLAN, web UI and RTSP.
VoIP phone system, a PBX with a web admin panel for extensions and SIP trunk diagnostics.
Managed switches and Wi-Fi, Aruba, Cisco, UniFi, or Netgear, managed over SSH or a web UI.

Exactly one category on that list, the Windows servers, can run a remote access agent. Everything else runs embedded firmware or sits under a vendor support contract that forbids third-party software.

Why Agents and Port Forwarding Both Fail Here

Agent-based tools reach a device only if that device runs the agent, which leaves every whiteboard, camera, switch, and phone system out of scope. Schools also run tight budgets and tight IT teams, so paying per device for the fraction of the estate an agent can cover, then keeping a second method for the rest, is exactly the overhead an MSP is trying to remove.

Port forwarding fails for a different reason. Exposing an MIS server holding pupil records, or a safeguarding NVR, directly to the internet is how you end up indexed in Shodan, and it is incompatible with the data protection duties a school carries. On CGNAT broadband there is no inbound address to forward to in the first place.

One Tunnel on the School Gateway

Instead of touching individual devices, install one WireGuard tunnel on the school router or firewall, MikroTik, pfSense, OPNsense, or any Linux gateway. The router dials outbound to ProxyLink and holds the tunnel open with a persistent keepalive. From that point every IP on the LAN and every VLAN behind the router is reachable, whether or not the target device can run software. Because the tunnel initiates outbound, CGNAT, dynamic IPs, and ISP port blocks are irrelevant, and the school network keeps zero open inbound ports. A scan of the school's ISP range finds nothing to connect to.

What Engineers Access

Once the tunnel is up, create a proxy link for each device and service:

MIS and file servers (port 3389), browser RDP to the Windows server, no mstsc.exe or VPN client on the engineer's laptop.
Whiteboards and NVRs (port 80 or 443), an HTTP or HTTPS proxy link to the embedded web UI for firmware and configuration.
Managed switches and Wi-Fi (port 22 or 443), browser SSH for CLI changes, or a proxy link to the management interface.
PBX admin (port 80 or 443), an HTTP proxy link for extension and SIP trunk management.
Camera RTSP (TCP link), a VPN-secured TCP proxy link to the NVR's RTSP port for raw video.

Segmented Networks and Multiple Sites

Schools segment heavily: a staff network, a pupil network, a CCTV VLAN, and an IoT or BMS VLAN. You do not need a tunnel per VLAN. Declare each subnet under Additional Subnets when you create the tunnel, and every declared subnet becomes reachable through the same peer. For a multi-academy trust where several sites share the same 192.168.1.0/24 addressing, ProxyLink assigns each gateway tunnel a unique subnet and translates transparently, so two sites with identical LAN ranges stay distinct with no renumbering.

Data Protection and the Audit Trail

Any system holding pupil or safeguarding data falls under GDPR, which expects access control, MFA where feasible, and a record of who reached what and when. ProxyLink supports two-factor authentication and logs every session with engineer identity, target IP and port, timestamp, and duration. RDP and SSH sessions can be recorded per link. The relay runs on EU infrastructure in Germany with no third-party remote-access network in the path, which keeps the data processing picture simple for an MSP handling school data.

Deployment

Budget 15 to 20 minutes per site for the first tunnel. On MikroTik, ProxyLink's auto-configuration connects over SSH and deploys the WireGuard config for you in under five minutes. After that, every device across every VLAN is reachable from a browser with no agent to maintain and no open ports on the school network. Guides for MikroTik, pfSense, OPNsense, and OpenWRT are in the docs.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. One tunnel per school router, every device on the network reachable from a browser.