Remote Proxmox access without the VPN
Every Proxmox cluster, one dashboard.
Your nodes dial out to a central relay and hold the connection open. You reach the real Proxmox web UI from anywhere — no VPN, no open ports, no address conflicts when every site runs the same subnet.
Reaching a remote Proxmox host is awkward by default
Proxmox ships a good web UI. What it doesn't ship is a safe way to reach it when the cluster is on someone else's network. The usual two options age badly.
Option A — VPN
- Overlapping subnets break it. Two sites on 192.168.1.0/24 can't both route.
- A route and a profile for every site, so onboarding a cluster becomes a network project.
- Access is a profile, not a login — nothing to audit or revoke per action.
Option B — Expose port 8006
- An inbound hole per cluster, each one to patch, rate-limit and monitor.
- No WAF, no central logs, and every admin gets root on every node.
- No organization boundary and no view of who reached what, when.
Invert the connection
Instead of reaching into the cluster's network, the cluster reaches out to the relay and keeps the tunnel alive. The cluster's address never enters the picture.
- Connect a node. One command installs the agent and adds a ClusterSentry panel to the Proxmox UI.
- The agent holds an outbound tunnel. 443 out only — the same direction as a browser. No inbound rules, no port forwards, no reachable address.
- Open the real Proxmox UI. Requests land on the node's own localhost:8006. Same console, same features, no fork.
| Concern | VPN | Exposed 8006 | ClusterSentry |
|---|---|---|---|
| Overlapping private ranges | ✗collides | ✓irrelevant | ✓irrelevant |
| Inbound firewall change | ✗per site | ✗per cluster | ✓none |
| Cluster reachable from the internet | ✓no | ✗yes | ✓no |
| Central roles & audit | ✗none | ✗none | ✓yes |
| Onboarding a new cluster | ✗network project | ✗open a port | ✓one command |
✓ no drawback · ✗ a real cost
Nothing invasive on the node
No fork of Proxmox, no replacement for pveproxy. A small agent runs alongside it, dials out, and forwards your sessions to the node's own web interface.
Node agent
One small binary per node. It authenticates, dials out, reconnects on its own, and forwards traffic to the local pveproxy.
Proxmox panel
A ClusterSentry panel inside the native Proxmox UI, showing relay status and connection health where you already work.
The relay
Terminates your session, authorizes every request, and multiplexes it onto the right node tunnel. Hosted, patched and monitored for you.
Dashboard
Nodes, clusters, telemetry, alerts, users and audit in one place — sampled on a schedule and cached, so nothing hammers your nodes.
Small attack surface, on purpose
If the cluster never accepts an inbound connection, there is nothing to reach. Everything else is about making the one outbound channel trustworthy.
Network posture
- Outbound-only tunnels. No inbound listener, no port forward, no public address.
- Authorized per request, not just at connect time, and scoped to one node.
- Origins are fixed in code — the app, issuer, CORS and plugin reject anything else.
Identity & data
- HS512 JWT with a key-id rotation ring, so signing keys roll without mass logouts.
- Secrets sealed in context-bound AES-256-GCM envelopes.
- MFA and passkeys, with a notice on every password, MFA, passkey or session change.
Verified installs
- Served from our domain over TLS, never a third-party host or a moving branch.
- Checksums verified before it runs. The installer fetches the release's SHA256SUMS from our domain and refuses to install any file whose hash doesn't match.
- Signature-verified releases. Configure a release public key and the installer also verifies the detached signature over every artifact, refusing to install if it is missing or wrong. Without a key it verifies checksums only, and tells you so.
Operations
- Audit trail for authentication, changes and administrative actions.
- Continuous dependency scanning and managed patching across the service.
Get started
ClusterSentry is a hosted service. Sign in to the gateway, open a cluster, and add your first node — the step-by-step node-agent guide lives inside the app, under Documents.