What Happens to Your Client Access If ProxyLink Goes Down?
The honest answer to the question every MSP should ask before committing to a remote access platform. What breaks, what doesn't, and what we're building next.
This is the question you should ask about any remote access platform before you put it in front of clients. We are going to answer it honestly — because if your vendor cannot give you a straight answer, that tells you something.
What the ProxyLink relay actually does
When an engineer opens a browser RDP, VNC, or SSH session through ProxyLink, the traffic path is: browser → ProxyLink server → WireGuard tunnel → target device. The ProxyLink server in the middle is doing two things: serving the web interface and relaying the terminal session.
The WireGuard tunnel is separate. It is a direct encrypted connection between the ProxyLink server and the router at the client site. It runs as a kernel-level WireGuard peer — it does not depend on the PHP application, the database, or the web server. The tunnel keeps its handshake independently.
This distinction matters when something goes wrong.
What breaks — and what does not
| Component | If relay fails |
|---|---|
| Open browser sessions (RDP / VNC / SSH) | Disconnect — reconnect when service recovers |
| New sessions | Cannot start until service recovers |
| ProxyLink dashboard | Unreachable |
| Windows ProxyLink Agent polling | Pauses — queued commands resume on recovery |
| WireGuard tunnel | Stays connected |
| Client LAN devices (NVR, PBX, switches) | Unaffected — keep working normally |
| Client internet connectivity | Unaffected |
ProxyLink is a remote access layer, not infrastructure the client site depends on to function. The NVR keeps recording. The PBX keeps handling calls. The switches keep switching. Only your remote access window closes temporarily — the site itself never goes down because of us.
How this compares to TeamViewer and AnyDesk
Traditional remote access platforms — TeamViewer, AnyDesk, and others — tightly couple authentication, session relay, and agent management into a single system. Both were breached in 2024. When their central infrastructure has problems, remote access availability degrades for all customers simultaneously, because every layer depends on the same backend.
ProxyLink's tunnel layer is independent of the web layer. A web application outage does not close the WireGuard tunnel. When the web layer recovers, engineers reconnect to tunnels that never dropped.
Our infrastructure
ProxyLink runs on a Hetzner VPS in Falkenstein, Germany. Hetzner offers a 99.9% network uptime SLA backed by redundant transit providers and their own AS. We chose Hetzner specifically for EU data residency — session traffic stays within German infrastructure — and for the reliability of their network layer.
We monitor the platform continuously. If something breaks at 3am, we know about it before you do.
Security of the relay layer
The WireGuard tunnel protects the path from ProxyLink's server to the client's router — traffic on that leg cannot be intercepted in transit. The relay itself (guacd) runs on ProxyLink's server and processes session frames — this is how session recording works. Each client site has its own WireGuard keypair, isolated at the kernel level; one site's tunnel cannot reach another's. Sessions require authenticated ProxyLink login with mandatory TOTP two-factor. Every connection is written to an immutable audit log with timestamp, engineer identity, and session duration. If you require end-to-end encryption where the relay server cannot access session content, a self-hosted deployment model is something we have considered for the future.
What we are building next
The current architecture has a single relay node. That is the honest limitation. We are evaluating a high-availability failover configuration — a second relay node that takes over automatically if the primary has an issue. This would reduce the blast radius of any infrastructure problem to seconds rather than minutes.
We will publish the HA architecture publicly when it is live. Until then, this post is the honest answer.
The right question to ask any vendor
Ask them: if your relay goes down at 2am, what exactly stops working, and what keeps working? If they cannot give you a precise answer that separates the tunnel layer from the application layer, you do not have enough information to make a decision.
ProxyLink is in early access. We are building in public, we are honest about the current state, and we do not oversell reliability we have not earned yet. If that approach works for you, try it free — no card required.