Third-Party Vendor Remote Access: One Device, Not Your Whole Network

Every MSP hits this sooner or later: a vendor needs to get onto one machine at a client site. The alarm company wants their panel server. A line-of-business software vendor needs to remote into the SQL box for an hour to run an upgrade. A camera installer wants to check an NVR. The fast answer is usually the wrong one. You hand them a VPN profile that drops them onto the whole LAN, share a remote-support ID and password, or forward a port for the afternoon and forget to close it. Each of those gives away far more than the job needs, and none of them leaves a clean record of what the vendor actually did.

Why the usual options are a problem

A client VPN puts the vendor on the network, not on the device. Once they connect, they can reach everything that subnet can reach, and revoking that access later means editing firewall rules or VPN configs nobody documented. Sharing remote-support credentials is worse: the same ID and password work forever, on any network, for anyone the vendor passes them to. Both TeamViewer and AnyDesk disclosed breaches in 2024, and credentials that never expire are exactly what an attacker wants to find. Opening a port, even briefly, publishes the device to every scanner on the internet for as long as the rule lives, and temporary rules have a way of becoming permanent.

Scope the access to one device and one service

ProxyLink turns the model around. The client site already runs a single outbound WireGuard tunnel, on its router or on a Windows box, so nothing is exposed on the WAN and there is no static IP for anyone to find. You, the MSP, then mint an access link: a single shareable URL that opens exactly one device on exactly one service. The vendor clicks it and lands on that one NVR panel, that one RDP session, or that one SSH shell. They never see the rest of the LAN, they never touch your other clients, and they never create a ProxyLink account to do it.

An access link can be scoped to a single proxy link, so the recipient gets one device and one port and nothing else. When the job is finished you delete the link and the access is gone. There is no firewall rule to unwind and no VPN profile left behind on the vendor's laptop.

Expiry and credentials are built in

Every access link carries an expiry you pick when you create it: one hour, 24 hours, seven days, or never. An expired link stops working on its own and shows the visitor an expired page, so the afternoon upgrade window closes whether or not anyone remembers to revoke it. That alone removes the most common vendor-access mistake, which is the standing door that nobody ever shut.

You can also bind the device's own login to the access link, so the vendor connects without you ever telling them the machine's username and password. For a remote desktop session over RDP or VNC, ProxyLink supplies those credentials to the browser session from the server side, so the password is used but never handed over. The vendor does the work; the secret stays yours.

Everything runs in the browser, and everything is logged

Because the session runs through ProxyLink, the vendor needs no VPN client, no RDP client, and no agent installed on their side. A web admin panel opens over an HTTP or HTTPS proxy link, a Windows box opens over browser RDP, a Linux appliance opens over a browser SSH terminal, and a camera or NVR opens straight in the tab. All the vendor needs is the URL and a browser.

Every connection made through an access link is written to the audit log: which link, which device, the source IP, the browser, the protocol, and the time. If you enable session recording on the underlying proxy link, the vendor's RDP, VNC, or SSH session is recorded as well, so you have a literal replay of what happened on the machine. For an MSP that has to answer to a client or to an auditor, "here is exactly who reached what, and here is the recording" is a very different conversation from "we think we closed that port."

Why this matters for MSPs

Third-party access is one of the most common ways a breach walks in through the front door, because the access granted almost always outlives the job and almost never gets watched. Scoping a vendor to one device, putting a clock on it, keeping the credentials out of their hands, and recording the session turns a standing risk into a controlled, time-boxed event. ProxyLink is EU-hosted on Hetzner in Germany and built on WireGuard, an open protocol, with no third-party routing in the path.

Try ProxyLink free at app.proxylink.dev, no card required and free during early access. Once a client site is on the tunnel, minting a scoped, expiring access link for a vendor takes under a minute. Setup guides for the router tunnels and the Windows deploy are in the docs.