Self-Storage Remote Access for MSPs: One Tunnel per Unmanned Site

Self-storage has gone unmanned. New facilities open with no counter staff, and older ones are being converted to run lights-out: tenants rent online, get a gate code by text, and let themselves in at 3am. What is left on site is a rack of IP devices with nobody standing next to them. A gate controller, a camera recorder, a payment kiosk, a small office PC running the facility management software, a switch, and the router that ties them together. When one of them stops answering, the operator or the MSP that manages the account has two bad options: drive out to an unmanned site, or leave a port open to the internet so they can get in remotely. ProxyLink removes both.

Why reaching a storage site is hard

Most of these facilities connect over consumer broadband or a cellular router, and both usually sit behind carrier-grade NAT (CGNAT), where the ISP shares one public address across many customers. There is no static IP and no port to forward. Even where a port could be forwarded, doing it to a camera recorder or the office PC is exactly the wrong move: it publishes the device that watches the whole yard, or the machine that holds tenant records, to every scanner on the internet. And because nobody is on site, every problem that cannot be fixed remotely turns into a scheduled truck roll.

One outbound tunnel per facility

ProxyLink never asks the site to accept an inbound connection. A single WireGuard tunnel dials outbound from the site to the ProxyLink relay, and the relay reaches back through that established tunnel to any device on the LAN. Because the tunnel initiates outbound, CGNAT and dynamic WAN addresses are irrelevant, and nothing is exposed on the internet. There is no open port to attack because there is no open port at all.

You put that tunnel in one of two places. If the site has a capable router or firewall, the tunnel lives there and one connection covers the whole LAN. MikroTik, pfSense, OPNsense, OpenWrt, and cellular routers such as the Teltonika RUT range all run a WireGuard client that dials an external peer. If the edge device cannot host it, run the ProxyLink one-liner on the site office PC instead:

irm https://app.proxylink.dev/deploy/{token} | iex

The script installs WireGuard, brings the tunnel up outbound, and registers the machine. Cameras are almost always kept on their own VLAN, apart from the office network. Declare each VLAN as an additional subnet on the tunnel and the one peer reaches all of them, so a single connection covers the office segment and the camera segment together.

What you actually reach

Once the tunnel is up you create a proxy link per device and service. Everything opens in a browser, with nothing installed on the target or on the engineer's laptop:

• The NVR or camera recorder, opened straight in the tab to check footage or a dropped stream
• The site office PC or on-prem management server over browser RDP, with no RDP client on your side
• A Linux-based controller or appliance over a browser SSH terminal
• Web admin panels for the switch, the router, or an on-site access controller over an HTTP or HTTPS proxy link

To be clear about where this helps: a lot of modern gate and access hardware is cloud-managed and needs no help reaching it. ProxyLink is for the local devices that have no cloud portal, the recorder, the office box, the network gear, the kiosk, which are exactly the ones that otherwise force a site visit.

Hand a contractor one device, not the network

Storage sites bring in outside trades: a camera installer, a locksmith, the company that services the gate motor. They do not need a VPN onto the LAN. In ProxyLink you mint an access link, a single shareable URL that opens exactly one device on exactly one service, with an expiry you choose. The contractor clicks it, lands on that one recorder or that one panel, and never sees anything else. They create no ProxyLink account to use it. When the job is done you delete the link and the access is gone, with no firewall rule to unwind and every connection written to the audit log.

Built to be audited

Storage operators hold tenant records and card payments, so the remote path in has to be defensible. ProxyLink is EU-hosted (Hetzner, Germany) and built on WireGuard, an open protocol, rather than a proprietary agent that phones home. Both TeamViewer and AnyDesk were breached in 2024. Access sits behind a ProxyLink login on top of the tunnel, every connection is logged (which engineer, which device, when), and session recording can be enabled per link for RDP, SSH, and VNC. If you run multiple facilities, each site is its own client group under one team, so an engineer sees only the sites they are assigned.

Try ProxyLink free at app.proxylink.dev, no card required and free during early access. A facility takes about ten minutes once the tunnel host is on WireGuard. Setup guides for MikroTik, pfSense, OPNsense, OpenWrt, Teltonika, and the Windows deploy are in the docs.