Router / Gateway — Full LAN Access

This is ProxyLink’s most powerful setup. One tunnel on a router or Linux gateway gives you access to every device on the network — cameras, NVRs, PBX systems, printers, switches — without installing anything on them.

How it works

The router establishes a WireGuard tunnel to ProxyLink. ProxyLink routes traffic through that tunnel to any IP on the router’s LAN. From the engineer’s perspective, they click a device in the browser and they’re in — regardless of what the device is.

Supported platforms

Platform	Method
MikroTik RouterOS 7	WireGuard native + auto-config
pfSense / OPNsense	WireGuard package
OpenWRT	WireGuard package
Linux (Raspberry Pi, Debian, Ubuntu)	Install script
Ubiquiti UniFi	WireGuard via Linux gateway

Setup

Create a Router / Gateway tunnel

In ProxyLink, go to Devices → + Add → Router / LAN site → select Router / Gateway. Enter a name and your LAN subnet (e.g. 192.168.1.0/24).

Download and install the config

Click Activate & Download. Select your platform — MikroTik, pfSense/OpenWRT, or Linux. ProxyLink generates the WireGuard config and install script.

MikroTik
pfSense / OPNsense
OpenWRT
Linux Gateway

Use Auto-Config Router for automatic setup via SSH, or download the .rsc script and run it manually in the terminal.

Install the WireGuard package, import the .conf file, and add the peer.

Run the downloaded .sh script as root. It installs WireGuard and sets up the interface.

Download and run the .sh install script. Works on Ubuntu, Debian, Raspberry Pi OS.

sudo bash proxylink-gateway-setup.sh

Add proxy links for each device

Once the tunnel is connected, go to your device on the Devices page → + Add service. Enter the device’s LAN IP and port. Repeat for each service.

Multi-VLAN support

ProxyLink supports multiple VLANs on a single tunnel. After creating the tunnel, go to the tunnel settings and add extra subnets under Additional Subnets.

Main LAN:    192.168.1.0/24
PBX VLAN:   192.168.40.0/24
Camera VLAN: 192.168.20.0/24

All three are reachable through the same tunnel — no additional configuration on the devices.

MikroTik auto-configuration

ProxyLink can configure MikroTik routers automatically via SSH:

Go to Devices → + Add → MikroTik — auto-configure
Enter the router’s IP, SSH credentials, and LAN interface name
ProxyLink connects via SSH and applies the WireGuard config, firewall rules, and mangle rules in one step

Do not add srcnat masquerade rules in RouterOS for ProxyLink traffic — this breaks return routing. ProxyLink uses NETMAP (not masquerade) for overlapping subnet translation.

Required MikroTik firewall rules

If configuring manually, add these rules to RouterOS:

# Allow ProxyLink to reach LAN
/ip firewall filter add chain=forward action=accept in-interface=proxylink out-interface=Local

# Allow return traffic
/ip firewall filter add chain=forward action=accept connection-state=established,related in-interface=Local out-interface=proxylink

# Mangle — exempt from load-balancing (add before load-balance rules)
/ip firewall mangle add chain=prerouting action=accept src-address=192.168.100.0/24 dst-address=10.100.0.0/16
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.0.0/16 dst-address=192.168.100.0/24

Getting Started

Tunnels

Proxy Links

Browser Terminals

MSP Features

Monitoring & Automations

Integrations

Reference

Router / Gateway — Full LAN Access

How it works

Supported platforms

Setup

Multi-VLAN support

MikroTik auto-configuration

Required MikroTik firewall rules

​How it works

​Supported platforms

​Setup

​Multi-VLAN support

​MikroTik auto-configuration

​Required MikroTik firewall rules

How it works

Supported platforms

Setup

Multi-VLAN support

MikroTik auto-configuration

Required MikroTik firewall rules