Skip to main content
Every device or network in ProxyLink is represented by a tunnel — a WireGuard peer that connects back to ProxyLink’s server. Proxy links, browser terminals, and monitoring all depend on an active tunnel.

​
Tunnel types

Router / Gateway

One tunnel on a router covers the entire LAN and all VLANs. No software on individual devices. Best for MSPs managing client sites.

Server / Device

A single server, VM, laptop, or Linux gateway running WireGuard directly. Best for accessing a specific machine.

Windows PC

Deployed via one-liner PowerShell command. Installs WireGuard + UltraVNC for browser RDP/VNC access.

​
VPN IP assignment

Each tunnel gets a unique IP in the 10.100.0.0/16 range (up to 65,534 peers). The IP is fixed for the lifetime of the tunnel and shown on the tunnel detail page.

​
Tunnel status

StatusMeaning
OnlineWireGuard handshake within the last 3 minutes
OfflineNo handshake — device unreachable or WireGuard stopped
Pending activationTunnel created but WireGuard not yet connected

​
Peer isolation

Each user’s tunnels are isolated from other users’ tunnels at the iptables level using ipsets. Cross-tenant traffic is impossible — even if two users share the same VPN IP range, they cannot reach each other’s devices.

​
Adding VLANs

After creating a router tunnel, add extra subnets from the tunnel detail page under Additional Subnets. ProxyLink will route traffic to those subnets through the same tunnel.