One of the most annoying things about managing remote MikroTik routers is realizing that the router you're trying to reach is sitting behind CGNAT.
No public IP.
No port forwarding.
No easy way to just open WinBox and connect.
And when you start doing this across multiple sites, things get messy quickly. Every site becomes its own little networking problem.
I wanted to get away from that.
So the idea became:
What if I could just connect my laptop to one private network and reach every router as if I were physically there?
10 routers.
10 different locations.
Different ISPs.
Some behind CGNAT.
Each router makes an outbound connection to TunGuard.
Once they're connected, I don't care where the router physically is anymore.
I just use its private tunnel IP:
WinBox → 10.100.x.x SSH → 10.100.x.x API → 10.100.x.x
Even the SSH jump host is there when I need it.
And the same network can connect sites to each other.
That's the part I really like.
I don't have to think about the physical location anymore.
The router could be across town, in another building, or behind CGNAT on some random ISP.
From my laptop, it just feels like:
another device on my network.
That's the experience I wanted TunGuard to provide:
remote infrastructure that feels local.
TunGuard is open source. Search for TunGuard on GitHub, grab the latest tanguard-binary release, and try it yourself.
. TunGuard is aimed at a different setup: self-hosted, WireGuard-based, and focused on managing routers/sites where I control the whole infrastructure.
FYI