As of now, you need to forward both HTTPS and VNC ports through a firewall if you have a LAN Proxmox VE server and want to web manage from the outside. HTTPS for the web interface, then VNC for the guest GUIs. I'm wondering how difficult it would be to automatically tunnel the VNC traffic through the HTTPS connection?