Solar Site Remote Access for MSPs: Reach Inverters, Data Loggers, and Modbus Behind CGNAT

A solar site is the definition of a network you cannot drive to. A rooftop array on a client's warehouse, a ground-mount farm two hours away, a car park canopy at a retail park: each one has inverters, a data logger, and often a revenue meter and a bank of string monitors, all sitting on a small local network that reports back to a portal. When the portal stops updating, or a firmware push is needed, or an inverter throws a fault the cloud dashboard cannot clear, someone has to reach the equipment directly. Traditional remote access makes that a site visit, because solar sites are almost never built for inbound connections.

Why Solar Sites Are Hard to Reach

Two things line up against you. First, connectivity. Most unmanned sites run on 4G or LTE through a router like a Teltonika RUT, or on whatever broadband the host building happens to have. Cellular links sit behind carrier-grade NAT (CGNAT), so the router has no public IP and no port to forward. Even fixed lines at a host site are usually a dynamic IP you do not control. There is no static address to point a monitoring tool at.

Second, the equipment. An SMA Sunny Tripower, a Fronius Symo, a Huawei SUN2000, a SolarEdge or Growatt inverter, an SMA Data Manager or Huawei SmartLogger data logger: these run embedded firmware. You cannot install a remote control agent on them. They expose a web UI and, in almost every case, a Modbus TCP interface on port 502 for SunSpec monitoring and control. That is all you get, and it is all you should need.

Port forwarding is not the answer even where it is technically possible. Exposing an inverter's web UI or an open Modbus port to the internet puts grid-connected hardware one weak credential away from a stranger, and Modbus has no authentication of its own. That is not a risk any O&M contractor wants on the books.

One Tunnel on the Site Router

ProxyLink reaches the whole site from a single outbound tunnel. You install one WireGuard tunnel on the site's router or gateway (a Teltonika RUT, a MikroTik, an OpenWRT box, or any Linux gateway). The router dials outbound to ProxyLink and holds the tunnel open with a persistent keepalive. Because the connection is initiated from the site, CGNAT, dynamic IPs, and ISP port blocks are all irrelevant. Nothing is installed on the inverters or the data logger. From that point every IP on the site network is reachable, and the site keeps zero open inbound ports. A scan of the cellular carrier's range finds nothing to connect to.

What You Actually Access

Once the tunnel is up, create a proxy link per device and service:

• Inverter and data logger web UIs (port 80 or 443): an HTTP or HTTPS proxy link to the embedded interface for firmware updates, fault clearing, and configuration. No cloud portal round trip, you are on the device itself.
• Modbus TCP monitoring (TCP link to port 502): a VPN-secured TCP proxy link so a SCADA tool or a SunSpec client on your laptop can poll live register data, string currents, and power output directly from the inverter.
• Revenue meters and gateways (TCP or HTTP link): reach a Modbus meter or a monitoring gateway on whatever port it listens on.
• On-site Linux gateway or logger (port 22): a browser SSH terminal for diagnostics, with session recording on paid plans.

All of it runs in a browser tab. There is no VPN client to install on the engineer's laptop and no per-site software to maintain.

Multi-Site Portfolios

An O&M contractor or MSP rarely manages one array. Group each solar site under its own client group, one tunnel per site, and scope engineers to the sites they cover. Many small sites reuse the same default LAN range, so several will land on 192.168.1.0/24. ProxyLink assigns each gateway tunnel a unique internal range and translates transparently, so two sites with identical addressing stay completely distinct with no renumbering. Every session is logged with engineer identity, target IP and port, timestamp, and duration, and WireGuard peer isolation is enforced at the kernel level so one site's tunnel can never reach another's.

Deployment

Budget around 15 minutes for the first tunnel. On MikroTik, ProxyLink's auto-configuration deploys the WireGuard config over SSH for you. After that, every inverter, logger, and meter on the site is reachable from a browser with no agent to maintain and no open ports facing the internet. Setup guides for MikroTik, Teltonika, OpenWRT, and pfSense are in the docs.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. One tunnel per solar site, every device reachable from a browser, no static IP and no port forwarding.