Guide contents
Proxmox VE
Proxmox's interface and console from outside, privately: only from your own computers.
Why it goes over TCP
Before: the server installed («Install the server») and the agent's machine joined («Connect your machines»). With --preset, add sets this app's port, options and checks.
Proxmox only serves HTTPS, on 8006 and with its own certificate. The preset publishes it as a private TCP service: no port open on the VPS, and only someone with a credential gets in. The connection stays encrypted end to end with Proxmox's certificate. If you would rather reach it from any browser, it goes as a web app below.
The server needs the [tcp] section from "SSH, RDP and databases". A private service does not need that range open in the firewall.
Publish it
On the agent's machine (Proxmox itself will do)
lnkstart add pve=192.168.1.10 --preset proxmox sudo lnkstart install
Get in from your laptop
On the VPS
sudo lnkstart server join-code laptop --names pve --connect-only
A credential that can only connect to pve, not publish anything.
On your laptop
lnkstart join LD1.xxxxx lnkstart connect pve --port 8006
Then, in the browser, https://127.0.0.1:8006. The certificate warning is the usual one: it is Proxmox's.
The noVNC console works: it is a WebSocket inside the same 8006. SPICE uses its own port (3128) and is not covered here.
As a web app, from any browser
On the agent's machine
lnkstart add pve=https://192.168.1.10:8006 --preset proxmox --password
With https:// the agent talks to Proxmox over its HTTPS: it pins Proxmox's own certificate the first time and refuses any other. Its sign-in is then on the Internet: --password makes LnkStart ask for a password first, and Proxmox's two-factor authentication is worth turning on. The noVNC console works this way too.