I played with the firewall settings on datacenter level (security groups is a nice feature) and on node level, while watching what iptables -v -n -L says, everything fine so far, and with the firewall off all rules are gone and default input target is accept. 
However, I can only connect to the pveproxy at port 8006 from the same subnet as the proxmox server (192.168.50. ) but not via VPN (client Ip would be 10.212. ).
tcpdump explicitely show the incomming syn packet (e.g. routing is ok) and the outgoing rst packet, thus pveproxy itself refuses to talk to my browser.
man page states that one can setup "apache like" rules in /etc/proxy/pveproxy, alas that file does not exist. Do I have to create it?
That would be counter intuitive, as webinterface install access default is "anything goes" ,as firewall is off,
but pveproxy default (sans /etc/proxy/pveproxy) apparently is "only my subnet".
Or am I missing something ?
However, I can only connect to the pveproxy at port 8006 from the same subnet as the proxmox server (192.168.50. ) but not via VPN (client Ip would be 10.212. ).
tcpdump explicitely show the incomming syn packet (e.g. routing is ok) and the outgoing rst packet, thus pveproxy itself refuses to talk to my browser.
man page states that one can setup "apache like" rules in /etc/proxy/pveproxy, alas that file does not exist. Do I have to create it?
That would be counter intuitive, as webinterface install access default is "anything goes" ,as firewall is off,
but pveproxy default (sans /etc/proxy/pveproxy) apparently is "only my subnet".
Or am I missing something ?