A Router / Gateway tunnel is ProxyLink’s most powerful setup. One WireGuard peer on a router covers the entire LAN and all VLANs — cameras, NVRs, PBX systems, switches, printers — without installing anything on those devices.
Router requirement: the gateway tunnel requires your router to support WireGuard LAN forwarding — the ability to forward traffic arriving through the WireGuard tunnel to devices on the local network. Some firmware (including certain Omada versions) implements WireGuard in client-only mode and cannot forward tunnel traffic to the LAN. If your router falls into this category, place a dedicated Linux gateway (Raspberry Pi, mini PC, or VM) on the LAN and run WireGuard there instead — it takes about 10 minutes and works reliably.
Setup
Create a Router / Gateway tunnel
Go to Devices → + Add → Router / LAN site → select Router / Gateway. Enter a name and your LAN subnet (e.g. 192.168.1.0/24).
Install the config on the router
Click Activate & Download and select your platform. MikroTik
pfSense / OPNsense
OpenWRT
Linux Gateway
Use Auto-Config Router for fully automatic setup via SSH. Or download the .rsc script and run it manually in the MikroTik terminal: Install the WireGuard package, add a new tunnel, and import the peer config. Add a gateway route for 10.100.0.0/16 via the WireGuard interface.
Run the downloaded .sh script as root. It installs the WireGuard package and sets up the interface automatically.
Run the install script as root:Works on Ubuntu, Debian, Raspberry Pi OS. The script enables IP forwarding and sets up routing. Add proxy links for each device
Once the tunnel is connected, go to your device on the Devices page → + Add service. Enter the device’s LAN IP and port. One proxy link per service — repeat for each device or service you want to expose.
Multi-VLAN support
Add extra subnets from the tunnel detail page under Additional Subnets. ProxyLink updates the WireGuard AllowedIPs and routing immediately — no reconnection needed.
Example — Hotel Anna setup:
One tunnel. All three VLANs accessible through the browser. For each additional VLAN, add matching mangle rules on the router to exempt ProxyLink traffic from load balancing.
Overlapping subnets
If two client sites use the same subnet (e.g. both use 192.168.1.0/24), ProxyLink handles this via NETMAP — each tunnel gets a unique assigned subnet in the 10.128.0.0/9 range for translation. No conflict between clients, no reconfiguration needed on either site.
MikroTik firewall rules
If configuring MikroTik manually, add these rules. Repeat the mangle rules for each additional VLAN subnet:
Do not add srcnat masquerade rules for ProxyLink traffic. Masquerade breaks return routing in RouterOS because mangle runs before NAT de-masquerade. ProxyLink uses NETMAP for overlapping subnet translation, not masquerade.
Wake-on-LAN
Set a MAC address on any proxy link and a Wake button appears. ProxyLink sends the magic packet through the tunnel to wake the device remotely.
Wake-on-LAN is not currently supported when the tunnel terminates directly on a MikroTik router, and Linux gateways deployed before late June 2026 need bc_forwarding=1 enabled. See Wake-on-LAN for the per-platform requirements. LAN scan
From the tunnel detail page, click LAN Scan to discover devices on the network automatically. ProxyLink probes the subnet and fingerprints devices, then lets you create proxy links for all of them in one click. 
