What you will learn: what Guard does between a staff laptop and your office server, the two connection methods you can choose from, what each one needs from your network, and what Prixl can and cannot see. There are no steps on this page; it is background for the set-up guides.
Time: about 5 minutes to read. You need: nothing.
The short version
Without Guard, staff who work from home reach the server by connecting Remote Desktop to the office’s public internet address. That same door is open to everyone else on the internet, and attackers try passwords on it all day. Guard replaces that open door with an encrypted tunnel built on WireGuard. Only devices you have invited can make the tunnel, and once your staff use it you can close Remote Desktop to the internet with one switch.
Staff still sign in to Windows with their usual username and password. Guard is the road to the server, not a replacement for the Windows sign-in.
The parts
- On the server: Prixl Warden. When your plan includes Guard, Warden sets Guard up by itself: it installs the tunnel software, creates the server’s keys and adds a Windows Firewall rule named Prixl-Guard-WireGuard for UDP port 51820. You manage everything from the Secure Access tab in the Warden dashboard.
- On each staff PC: the Prixl Guard app (Windows 64-bit). It sits in the notification area next to the clock and shows whether the tunnel is connected.
- Invite codes: you create one code per person in the dashboard. The code works once and expires after 24 hours. When a person enters it, their PC becomes a “peer” and takes one seat.
- Prixl’s cloud: keeps the list of invites and peers and helps the two ends find each other. It does not carry your Remote Desktop session in either connection method.
The two connection methods
The admin picks one per server under Secure Access Settings > Connection method. Staff do not choose; their app follows the server.
| Prixl Magic (default) | Classic Static IP | |
|---|---|---|
| Router setup | None. No port forwarding. | Forward UDP port 51820 on the router to the server. |
| Public IP needed | No. Works behind most office routers, including CGNAT connections. | Yes. The server must have a real public IP that the internet can reach. |
| How the connection is made | Prixl’s cloud helps both ends open a direct path. If that fails, an automatic relay is used. | The staff PC connects straight to your office’s public IP. |
| Uses Prixl’s cloud on every connect | Yes | No, once the tunnel is set up |
For Remote Desktop work such as Tally and office files, either method is normally enough. A static IP is never required: Prixl Magic exists so that offices without one can use Guard. See Change the connection method for how to switch.
The automatic relay
Some networks will not allow a direct path between two PCs, for example certain mobile hotspots, CGNAT connections and offices with two internet lines. With Prixl Magic, the Guard app first tries a direct connection for about 20 seconds. If that fails, it switches to a relay on its own: both ends connect outwards to a relay run on Cloudflare’s network, and the tunnel runs through it. There is no setting for this and nothing to configure. The relay only passes on encrypted tunnel traffic; it takes no part in the key exchange and cannot read what is inside.
What your network needs
- Prixl Magic: normal outgoing internet on the server and the staff PC, including outgoing UDP. Nothing to change on the router.
- Classic Static IP: UDP 51820 forwarded from the router to the server’s office (LAN) address. Warden tries to set this up on its own if the router supports UPnP and shows the result on the Network Status card. If the server’s public IP changes, Warden registers the new one.
- Both: the staff PC must be able to reach Prixl’s service at https://api.warden.prixl.io when it redeems its invite code.
Security: what is protected and what Prixl sees
- Keys stay on the devices. Each staff PC creates its own key pair when it redeems the invite and sends only the public half to Prixl. The server’s private key is stored encrypted on the server and is not sent to Prixl.
- Prixl does not see your work. Remote Desktop runs inside the encrypted tunnel. Prixl does not see the Remote Desktop session or the tunnel’s contents.
- What Prixl’s cloud stores: your organisation and server registration (the server’s public key and network addresses), each peer’s display name from the invite, its tunnel address, public key and when it was last seen, the invites, and short-lived records of each side’s public IP while a connection is being set up.
- Who can reach Remote Desktop once you lock it: the office network (LAN), staff connected through Guard, and any addresses on your Trusted IPs list. Attempts from the rest of the internet are blocked by the Windows Firewall.
- The Guard port itself: with Classic Static IP, UDP 51820 is open to the internet. WireGuard does not answer packets from devices that do not hold a valid key, so a port scan gets no reply.
- Every change is recorded. Invites, revocations and settings changes are emailed to your admin addresses and kept in the dashboard’s activity log.
What Guard does not do
- It does not replace the Windows password. Use strong passwords on the server as well; we recommend at least 15 characters.
- It does not run on Mac, iPhone, iPad or Android today, and the standard WireGuard apps cannot join a Prixl Magic server.
- It does not start by itself when Windows starts. Staff open it when they want to work.
- It does not close Remote Desktop to the internet until you switch on Lock RDP to Secure Access only. See Lock Remote Desktop safely.
Next
Next: Set up Secure Access on your server. Back to Prixl Guard (Secure Access) guides.