Independent of using a VPN connection, you will need to know the WAN IP address for the location. If the WAN IP is dynamically assigned by the ISP (i.e. not a fixed/static IP), then you will need to utilise a Dynamic DNS service like A Dynamic DNS service will allow you to always resolve the IP address of the location using your chosen domain-name e.g.

To determine what the WAN IP address of your location is, open a browser session and navigate to and it will list the current WAN IP for your network.

You will need to ensure that port forwarding is enabled within the router configuration at the site. Specifically, Port 1319, which is the default port for AMX ICSP communications, will need to be forwarded to the IP Address of your target NetLinx master. You may want to turn on Security for the NetLinx master, and select ICSP and Encrypt ICSP. If you do so, all devices that connect to the NI master via ICSP will need to have their connection profiles updated with the Username/Password that you define within the NetLinx's Security - User Level: profile.

Then, from _outside_ of the target network (in case your router does not provide reverse lookup), to determine if port forwarding is up and running correctly, open a command prompt session and type in: "telnet [the_WAN_IP] 1319" . If port forwarding is configured correctly, you should see something similar to the following:

☻[☻☺☺☺ù☺♦☺☺+☺|v3.60.453NI MasterAMX LLC♠
A ☺zv3.60.453vxWorks ImageAMX LLC|☻M☻☺☺☺ù☺♦☻☺☺+N/A ☺{v3.
60.453BootROMAMX LLC¶☻\☻☺☺☺ù☺♦♥☺☺0000000000000000☺v1.30.8AXLink I/F uController

All going well, this has proven that you can establish a connection to your NetLinx master from outside of the target network.

At that point, all that is required to connect with the NetLinx master from TPControl is to enter the WAN IP or Host-Name in the profiles Host field, and TPControl will establish a connection with the NetLinx master when connecting to any network.