Proxmox VE Remote Access for MSPs: Web UI, VM Console, and Shell Without Port Forwarding

Proxmox VE has quietly become the hypervisor MSPs reach for at client sites: open, cheap, and capable enough to run a small business's entire server stack on one box. The trouble starts the moment you leave the building. The Proxmox web interface, the VM consoles, and the node shell all sit on a LAN behind whatever router the client happens to have, and that router is almost never set up to let you back in. The usual answers, port forwarding and a static IP, are exactly what you should not be doing to a machine that runs every VM the client owns.

Why Proxmox is hard to reach remotely

The Proxmox VE management interface is served over HTTPS on port 8006, and the REST API shares that same port. To administer a node you point a browser at https://node-ip:8006, which is fine on the LAN and useless from your office unless something makes that port reachable. Every traditional fix carries a cost:

• Forwarding port 8006 exposes the full management API of your hypervisor to the public internet, one weak root password or one unpatched CVE away from a full compromise of every guest on the box.
• A static public IP is something many small sites do not have, and it is worthless behind carrier-grade NAT on a 4G, 5G, or Starlink link, where there is no inbound address to forward at all.
• An agent on the host is not really an option. Proxmox is a Debian-based appliance you are meant to keep clean, and a per-device remote-control agent cannot reach the VM consoles or the API anyway.

One outbound tunnel per site

ProxyLink puts a single WireGuard tunnel on the site's router or gateway: a MikroTik, an OPNsense or pfSense firewall, an OpenWRT box, or a small Linux host. The tunnel dials outbound to ProxyLink and holds itself open with a keepalive, so CGNAT, a dynamic IP, and ISP port blocks stop mattering. Nothing is ever accepted inbound at the site. The Proxmox host needs no software of its own. Once the tunnel is up, every IP on that LAN is reachable through it, the hypervisor included, and the site keeps zero open ports. A scan of the client's public address finds nothing to connect to.

What you actually reach

With the tunnel in place you create a proxy link per service on the Proxmox node:

• The management web UI (HTTPS, 8006): an HTTPS proxy link to node-ip:8006 gives you the full interface from a browser tab, on a clean ProxyLink subdomain with a valid certificate. VM and container lifecycle, storage, snapshots, backup jobs, and the cluster view all behave as they do on the LAN.
• The VM console: Proxmox delivers its in-browser noVNC console through that same 8006 service over a WebSocket. When you need console access to a guest, use a TCP proxy link to port 8006. A ProxyLink TCP link is a raw passthrough, so the TLS session and the console WebSocket travel end to end untouched and the console opens exactly as it does on site. SPICE is the exception: it hands your browser a config file to open in an external Remote Viewer client, so it sits outside the browser-only path.
• The node shell (SSH, 22): a browser SSH terminal into the node for qm, pct, zpool, and journalctl when the GUI is not enough, with session recording available on paid plans.
• Proxmox Backup Server (HTTPS, 8007): if the site runs PBS, its web interface listens on port 8007. Add a second HTTPS proxy link and manage datastores, prune and garbage-collection jobs, and verify tasks the same way.

All of it runs in a browser. There is no VPN client on your laptop and no per-node software to keep alive.

Clusters and many identical sites

Each node in a Proxmox cluster serves its own web UI on 8006, so give each node its own link and reach any of them directly. Across a portfolio the problem is sameness: small sites reuse the same default ranges, so a dozen clients will all sit on 192.168.1.0/24. ProxyLink assigns every gateway tunnel a unique internal range and translates transparently, so identical LANs never collide and you renumber nothing. WireGuard peer isolation is enforced in the kernel, so one client's tunnel can never see another's, and every session is logged with engineer identity, target IP and port, and duration.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. One tunnel per site, your whole Proxmox estate reachable from a browser, no port forwarding and no static IP. Setup guides for MikroTik, pfSense, OPNsense, and OpenWRT are in the docs.