[TUTORIAL] Reaching the Proxmox web UI behind CGNAT without port forwarding or a VPN

[Abnersouza7]

A common question here is how to get to a Proxmox host at a relative's house or on a connection with no public IP. Tailscale and Cloudflare Tunnel are the usual answers and they work well. Here's another option, in case it fits your setup.

A small agent on the PVE host (it's Debian, and the agent is a static binary) connects out on 443. Then from your laptop:

fh forward pve 8006
# open https://localhost:8006

You also get a browser shell on the host, CPU/memory/disk/temperature, and an alert if the box goes offline, which is the part I wanted for machines I can't walk over to.

Disclosure: I'm the developer. Free for 5 devices, and the agent is open source (Apache-2.0): https://github.com/Abnersouza7/fieldhand-agent
https://fieldhand.dev/?utm_source=proxmox

 

[LnxBil]

So basically this is a tailscale/cloudflare tunnel alternative with an open source client?

Another approach - just for the sake of completeness - is to use a cheap virtual server somewhere in the network with a fixed IPv4 / IPv6 and use that as a vpn endpoint and reverse proxy with additional security like mTLS or something like that. I, personally, would always use somethine that no other entity controls.

 

[UdoB]

I am always happy to see some additional alternative to pop up. Thank you!

My own paranoia level is a little bit higher than "normal" users may have, and so I would never use Cloudflare. Traffic going through their networks always is their traffic, not the customers. (And the keys their SSL-certificates are based on are in their possession, not in mine. Even when the presented name is myhost.mydomain.tld!)

Not sure how your solution (with a closed source server?) fits into that problematic picture.

That's why I prefer to run my own external endpoint/entrypoint utilizing https://github.com/fosrl/pangolin on a $2/month VPS...