🪟

Windows WireGuard Setup Guide

Windows PCs do not need the manual WireGuard route. ProxyLink generates a single PowerShell command that installs and configures everything for you, including browser VNC, so the PC is reachable the moment it comes online. Setup takes about two minutes and works over RMM or Group Policy for a whole fleet.

Add the PC in ProxyLink

Go to Devices → + Add → Windows PC. Give it a label and save. ProxyLink shows you a one-line command with a single-use token that expires in 30 minutes.

Run the one-liner on the PC

Open PowerShell as Administrator on the target PC and paste the command:

irm https://app.proxylink.dev/deploy/<your-token> | iex

It installs WireGuard, writes the tunnel config, installs UltraVNC with a per-device password, registers the ProxyLink agent, and adds a watchdog that restarts the tunnel if it ever stops. The script is idempotent, so running it twice is safe.

Watch it come online

The PC reports its own hostname back to ProxyLink once the tunnel connects, so it names itself on the Devices list and switches to Online. You do not need to look up its IP.

Connect from the browser

Click the device and choose VNC or RDP. The session opens in the browser with no client software and no open ports on the PC. File transfer works from the toolbar in both.

Deploying to a fleet

The same one-liner runs unattended from NinjaRMM, Datto, ConnectWise Automate, or a Group Policy startup script. Generate one token per PC.

Good to know

Prefer to do it by hand? Create the PC as a Public Server / Device instead, download the config from the tunnel page, and import it into the WireGuard client from wireguard.com/install. You get the tunnel, but not UltraVNC, the agent or the watchdog.

WireGuard on Windows adds a virtual network adapter. It appears in Device Manager as "WireGuard Tunnel". This is normal.

Some antivirus products quarantine the UltraVNC server mid-install. If the tunnel comes up but VNC does not, the deploy tells you so and the PC is still reachable by RDP.

What you get once the tunnel is up

Browser RDP, VNC, and SSH — open a terminal or remote desktop to any device behind the tunnel straight from the ProxyLink dashboard. No client software, no open ports on your side.
Proxy links — share an HTTPS URL that forwards to any internal web interface (NAS, NVR cameras, PBX admin panels, router UIs) with ProxyLink login in front of it.
No public exposure — the device keeps zero open ports and needs no static IP. The tunnel is outbound-only WireGuard to EU-hosted infrastructure. Read more about agentless remote access and NIS2 compliance.

Ready to connect?

Create a free account and set up your first tunnel in minutes. Free during early access — no card required.

Start free → Other platforms

Setup guides for other platforms

🐧Linux Server 🍎macOS 🤖Android 📱iPhone / iPad 🔧OpenWrt 🌐GL.iNet 🗄️Synology NAS 📡Asus Merlin ⚙️MikroTik RouterOS 7 📶TP-Link 🛡️OPNsense 🔒pfSense 🔵Ubiquiti UniFi Gateway 🔷Ubiquiti EdgeRouter 📻Netgear 🔌Zyxel