UPS and PDU Remote Access for MSPs: Reach Network Management Cards Without Exposing Them

Every server room and network closet has a UPS keeping the racks alive, and most of them carry a small network card that turns the UPS into a managed device: APC calls it the Network Management Card, Eaton calls it the Gigabit Network Card, and the switched and metered PDUs in the same rack expose an equivalent interface. That card is how you check runtime and battery health, trigger a graceful shutdown or reboot of the protected load, silence an alarm at 2am, schedule a self-test, or power-cycle a hung device through a switched PDU outlet. It is also, almost always, the one device you can never install anything on.

This guide shows how to give your team browser access to every UPS and PDU management card across your client sites, with no static IP, no open ports, and no agent, because there is no agent path to a UPS card in the first place.

Why UPS and PDU cards are hard to reach

A UPS network card runs closed embedded firmware. There is no operating system to log into, no RMM package to push, and no remote-control client to install. You reach it over the network or you do not reach it at all. The APC Network Management Card 3 serves its interface over HTTP and HTTPS, a command line over SSH and Telnet, and data over SNMP v1, v2c and v3, and it also speaks Modbus and BACnet for building systems. Eaton's Gigabit Network Card (Network-M2) is the same shape: an HTTPS web UI over TLS, SSH, SNMP, and a RESTful API over HTTPS. Every one of those is a listening service that has to sit somewhere.

And that somewhere should never be the public internet. Good practice puts UPS and PDU cards on a dedicated management VLAN with no default route out, because embedded power-management firmware has a long history of serious remote vulnerabilities, and a compromised card can shut down or reboot everything the UPS protects. Forwarding a port to one is close to the worst thing you can do in a rack. So the two usual answers both fail: a port forward publishes your most sensitive control plane to every scanner on the internet, and a per-engineer client VPN is heavy to roll out across dozens of sites and still needs the management VLAN routed correctly at the far end.

Reach the whole management VLAN through one tunnel

ProxyLink works from the inside out. You install one WireGuard tunnel on the site's router or gateway: a MikroTik, a pfSense or OPNsense box, an OpenWrt router, or any Linux host down to a Raspberry Pi. The tunnel dials outbound to ProxyLink and holds itself open with a keepalive, so the site never accepts an inbound connection, needs no static IP, and works fine behind carrier-grade NAT. Declare the management VLAN as an additional subnet on the tunnel and every UPS card, PDU and server BMC on it becomes reachable, with nothing installed on any of them.

The links you create

Once the tunnel is up, you create a proxy link per interface on each card:

• Web UI (HTTPS, port 443): an HTTPS proxy link to the card gives you the dashboard, runtime and battery figures, load control and self-test scheduling in a browser tab. ProxyLink's default appliance mode rewrites the Origin and Referer headers so an appliance's built-in CSRF check accepts the proxied request, the same handling that makes Synology, UniFi and pfSense UIs work through it.
• Command line (SSH): a browser SSH terminal onto the card's CLI, with no client on your laptop, for scripted checks or firmware tasks.
• SNMP (UDP 161): SNMP polling runs over UDP port 161, so create a UDP link to the card on 161 and point your monitoring platform at the ProxyLink endpoint to pull battery, load and temperature values into the dashboards you already run.

Because the tunnel carries the whole VLAN rather than a single port, you are not limited to one protocol per device: the same card can carry an HTTPS link for the console, an SSH link for the CLI, and a UDP link for SNMP at the same time.

What this looks like for an MSP

One tunnel per client site covers the production LAN, the management VLAN, and any other segment you declare, all through the same peer. An engineer opens ProxyLink, clicks a site's UPS, and is on the card in a browser with no VPN client to launch and no jump box to SSH through first. Every session is tied to an engineer identity, with the target IP, port, start time and duration recorded, and access requires a ProxyLink login. The management network keeps zero open inbound ports and stays invisible to internet scans. Traffic runs over open WireGuard, and the relay is hosted in the EU on German infrastructure with no third-party routing of the session.

This is the class of access that agent-based tools cannot give you. RMM and remote-control products reach an operating system; a UPS management card has none. When the power event hits and you need to read runtime and issue a controlled shutdown before the batteries go, a browser tab beats a two-hour drive.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. Setup guides for MikroTik, pfSense, OPNsense and Linux gateways are in the docs.