[TUTORIAL] Reaching the Proxmox web UI behind CGNAT without port forwarding or a VPN

[Abnersouza7]

A common question here is how to get to a Proxmox host at a relative's house or on a connection with no public IP. Tailscale and Cloudflare Tunnel are the usual answers and they work well. Here's another option, in case it fits your setup.

A small agent on the PVE host (it's Debian, and the agent is a static binary) connects out on 443. Then from your laptop:

fh forward pve 8006
# open https://localhost:8006

You also get a browser shell on the host, CPU/memory/disk/temperature, and an alert if the box goes offline, which is the part I wanted for machines I can't walk over to.

Disclosure: I'm the developer. Free for 5 devices, and the agent is open source (Apache-2.0): https://github.com/Abnersouza7/fieldhand-agent
https://fieldhand.dev/?utm_source=proxmox

 

[LnxBil]

So basically this is a tailscale/cloudflare tunnel alternative with an open source client?

Another approach - just for the sake of completeness - is to use a cheap virtual server somewhere in the network with a fixed IPv4 / IPv6 and use that as a vpn endpoint and reverse proxy with additional security like mTLS or something like that. I, personally, would always use somethine that no other entity controls.

 

[UdoB]

I am always happy to see some additional alternative to pop up. Thank you!

My own paranoia level is a little bit higher than "normal" users may have, and so I would never use Cloudflare. Traffic going through their networks always is their traffic, not the customers. (And the keys their SSL-certificates are based on are in their possession, not in mine. Even when the presented name is myhost.mydomain.tld!)

Not sure how your solution (with a closed source server?) fits into that problematic picture.

That's why I prefer to run my own external endpoint/entrypoint utilizing https://github.com/fosrl/pangolin on a $2/month VPS...

 

[bl1mp]

So basically this is a tailscale/cloudflare tunnel alternative with an open source client?

Another approach - just for the sake of completeness - is to use a cheap virtual server somewhere in the network with a fixed IPv4 / IPv6 and use that as a vpn endpoint and reverse proxy with additional security like mTLS or something like that. I, personally, would always use somethine that no other entity controls.

Yes, this also my approach.
In addition there are also some handy tools to generate Wireguard configs via GUI.

This kind of setup is also very useful, because you avoid to publish your setup on a DynDNS Provider, that get scraped on a regular base.

BR, Lucas

 

[Abnersouza7]

Thanks, all three of you. Fair questions, so here are the specifics.

@LnxBil yes, roughly: the agent and the fh CLI are open source (Apache-2.0); the relay is not.

@UdoB what the relay can see depends on how you connect:
- fh forward pve 8006 and fh ssh pass raw bytes. Your browser does TLS with pveproxy's own certificate, and ssh checks the host key, so the relay carries ciphertext it can't read.
- The browser shell and the in-dashboard "Web page" view are terminated at the relay, so it sees that traffic.
- Beyond traffic: the agent accepts shell and job requests from the relay, so whoever runs the relay can get a root shell on the host. You are trusting me with that, the same way you'd trust Tailscale's coordination server or Cloudflare.

If no outside party can be in that position, what you and Lucas describe (WireGuard to a cheap VPS, Pangolin or a reverse proxy with mTLS) is the right setup, and I'd point people to it too. Fieldhand is for people who'd rather not run and patch that VPS, or who want the disk/temperature/offline alerts alongside it.