Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.proxylink.dev/llms.txt

Use this file to discover all available pages before exploring further.

This is ProxyLink’s most powerful setup. One tunnel on a router or Linux gateway gives you access to every device on the network — cameras, NVRs, PBX systems, printers, switches — without installing anything on them.

​
How it works

The router establishes a WireGuard tunnel to ProxyLink. ProxyLink routes traffic through that tunnel to any IP on the router’s LAN. From the engineer’s perspective, they click a device in the browser and they’re in — regardless of what the device is.

​
Supported platforms

PlatformMethod
MikroTik RouterOS 7WireGuard native + auto-config
pfSense / OPNsenseWireGuard package
OpenWRTWireGuard package
Linux (Raspberry Pi, Debian, Ubuntu)Install script
Ubiquiti UniFiWireGuard via Linux gateway

​
Setup

1

Create a Router / Gateway tunnel

In ProxyLink, go to Tunnels → + New Tunnel → select Router / Gateway. Enter a name and your LAN subnet (e.g. 192.168.1.0/24).
2

Download and install the config

Click Activate & Download. Select your platform — MikroTik, pfSense/OpenWRT, or Linux. ProxyLink generates the WireGuard config and install script.
Use Auto-Config Router for automatic setup via SSH, or download the .rsc script and run it manually in the terminal.
3

Add proxy links for each device

Once the tunnel is connected, go to Proxy Links → + Create Proxy Link. Enter the device’s LAN IP and port. Repeat for each service.

​
Multi-VLAN support

ProxyLink supports multiple VLANs on a single tunnel. After creating the tunnel, go to the tunnel settings and add extra subnets under Additional Subnets. 
Main LAN:    192.168.1.0/24
PBX VLAN:   192.168.40.0/24
Camera VLAN: 192.168.20.0/24
All three are reachable through the same tunnel — no additional configuration on the devices.

​
MikroTik auto-configuration

ProxyLink can configure MikroTik routers automatically via SSH:
  1. Go to Tunnels → Auto-Config Router
  2. Enter the router’s IP, SSH credentials, and LAN interface name
  3. ProxyLink connects via SSH and applies the WireGuard config, firewall rules, and mangle rules in one step
Do not add srcnat masquerade rules in RouterOS for ProxyLink traffic — this breaks return routing. ProxyLink uses NETMAP (not masquerade) for overlapping subnet translation.

​
Required MikroTik firewall rules

If configuring manually, add these rules to RouterOS: 
# Allow ProxyLink to reach LAN
/ip firewall filter add chain=forward action=accept in-interface=ProxyLink out-interface=Local

# Allow return traffic
/ip firewall filter add chain=forward action=accept connection-state=established,related in-interface=Local out-interface=ProxyLink

# Mangle — exempt from load-balancing (add before load-balance rules)
/ip firewall mangle add chain=prerouting action=accept src-address=192.168.100.0/24 dst-address=10.100.0.0/24
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.0.0/24 dst-address=192.168.100.0/24