> ## Documentation Index
> Fetch the complete documentation index at: https://proxylink.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Router / Gateway
> One WireGuard tunnel on a router gives access to every device on the LAN and all VLANs. No software on individual devices.
A Router / Gateway tunnel is ProxyLink's most powerful setup. One WireGuard peer on a router covers the entire LAN and all VLANs — cameras, NVRs, PBX systems, switches, printers — without installing anything on those devices.
## Supported platforms
| Platform | Support | Notes |
| ------------------------------------ | ---------- | --------------------------------------------------------------------- |
| MikroTik RouterOS 7 | ✅ Full | WireGuard native + auto-config |
| pfSense / OPNsense | ✅ Full | WireGuard package |
| OpenWRT | ✅ Full | `luci-proto-wireguard` package |
| Linux (Debian, Ubuntu, Raspberry Pi) | ✅ Full | Install script, works everywhere |
| Omada (TP-Link) | ⚠️ Limited | WireGuard client mode may not forward traffic to LAN — see note below |
| Most consumer routers | ⚠️ Varies | Depends on whether the firmware supports WireGuard LAN forwarding |
**Router requirement:** the gateway tunnel requires your router to support **WireGuard LAN forwarding** — the ability to forward traffic arriving through the WireGuard tunnel to devices on the local network. Some firmware (including certain Omada versions) implements WireGuard in client-only mode and cannot forward tunnel traffic to the LAN. If your router falls into this category, place a dedicated Linux gateway (Raspberry Pi, mini PC, or VM) on the LAN and run WireGuard there instead — it takes about 10 minutes and works reliably.
## Setup
Go to **Devices** → **+ Add** → **Router / LAN site** → select **Router / Gateway**. Enter a name and your LAN subnet (e.g. `192.168.1.0/24`).
Click **Activate & Download** and select your platform.
Use **Auto-Config Router** for fully automatic setup via SSH. Or download the `.rsc` script and run it manually in the MikroTik terminal:
```
/import file=proxylink-config.rsc
```
Install the WireGuard package, add a new tunnel, and import the peer config. Add a gateway route for `10.100.0.0/16` via the WireGuard interface.
Run the downloaded `.sh` script as root. It installs the WireGuard package and sets up the interface automatically.
Run the install script as root:
```bash theme={null}
sudo bash proxylink-gateway-setup.sh
```
Works on Ubuntu, Debian, Raspberry Pi OS. The script enables IP forwarding and sets up routing.
Once the tunnel is connected, go to your device on the **Devices** page → **+ Add service**. Enter the device's LAN IP and port. One proxy link per service — repeat for each device or service you want to expose.
## Multi-VLAN support
Add extra subnets from the tunnel detail page under **Additional Subnets**. ProxyLink updates the WireGuard AllowedIPs and routing immediately — no reconnection needed.
**Example — Hotel Anna setup:**
| VLAN | Subnet | Devices |
| ----------- | ----------------- | ---------------------------- |
| Main LAN | `192.168.1.0/24` | Windows PCs, printers, NAS |
| PBX VLAN | `192.168.40.0/24` | PBX admin panel, VoIP phones |
| Camera VLAN | `192.168.20.0/24` | NVR, IP cameras |
One tunnel. All three VLANs accessible through the browser. For each additional VLAN, add matching mangle rules on the router to exempt ProxyLink traffic from load balancing.
## Overlapping subnets
If two client sites use the same subnet (e.g. both use `192.168.1.0/24`), ProxyLink handles this via NETMAP — each tunnel gets a unique assigned subnet in the `10.128.0.0/9` range for translation. No conflict between clients, no reconfiguration needed on either site.
## MikroTik firewall rules
If configuring MikroTik manually, add these rules. Repeat the mangle rules for each additional VLAN subnet:
```routeros theme={null}
# Forward chain
/ip firewall filter add chain=forward action=accept in-interface=proxylink out-interface=Local comment="ProxyLink to LAN"
/ip firewall filter add chain=forward action=accept connection-state=established,related in-interface=Local out-interface=proxylink comment="ProxyLink return traffic"
# Mangle — exempt from load-balancing (must be before load-balance rules)
/ip firewall mangle add chain=prerouting action=accept src-address=192.168.1.0/24 dst-address=10.100.0.0/16 comment="ProxyLink"
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.0.0/16 dst-address=192.168.1.0/24 comment="ProxyLink"
```
Do not add `srcnat masquerade` rules for ProxyLink traffic. Masquerade breaks return routing in RouterOS because mangle runs before NAT de-masquerade. ProxyLink uses NETMAP for overlapping subnet translation, not masquerade.
## Wake-on-LAN
Set a MAC address on any proxy link and a **Wake** button appears. ProxyLink sends the magic packet through the tunnel to wake the device remotely.
Wake-on-LAN is **not currently supported when the tunnel terminates directly on a MikroTik router**, and Linux gateways deployed before late June 2026 need `bc_forwarding=1` enabled. See [Wake-on-LAN](/docs/tunnels/wake-on-lan) for the per-platform requirements.
## LAN scan
From the tunnel detail page, click **LAN Scan** to discover devices on the network automatically. ProxyLink probes the subnet and fingerprints devices, then lets you create proxy links for all of them in one click.