Secure Remote Access to Proxmox with Cloudflare Tunnel and Zero Trust

Overview

Proxmox Virtual Environment (VE) is a powerful open-source virtualization platform for managing virtual machines and containers. While Proxmox is easy to deploy on a home server, securely accessing it over the internet requires careful planning to avoid exposing your network.

In this guide, I demonstrate how I deployed Proxmox on my home lab and secured remote access using Cloudflare Tunnel and Cloudflare Zero Trust Access with email-based Multi-Factor Authentication (MFA). This approach eliminates the need for port forwarding while providing an additional authentication layer before users can even access the Proxmox login page.

Why This Setup?

Instead of exposing port 8006 directly to the internet, Cloudflare Tunnel creates an encrypted outbound connection between Proxmox and Cloudflare's network.

Key Benefits

No port forwarding required
Hide your home IP address
Secure encrypted connection
Email-based MFA
Cloudflare Zero Trust integration
Automatic HTTPS
Simple remote management
Better protection against unauthorized access

Architecture

This deployment consists of:

Proxmox Virtual Environment
Cloudflare Tunnel
Cloudflare Zero Trust
Custom Domain
Email One-Time Passcode (OTP)

Every request first passes through Cloudflare Access before reaching the Proxmox web interface, ensuring only authorized users can access the server.

Getting Started

Install Proxmox VE

Install Proxmox on your dedicated server using the official installation ISO.

After installation:

Configure a static IP address
Access the Web UI
Update the system packages
Configure the free (No-Subscription) repository if applicable

Create a Cloudflare Tunnel

Open the Cloudflare Zero Trust Dashboard.

Navigate to:

Networks → Tunnels & Mesh

Create a new Cloudflared Tunnel and give it a descriptive name.

Install the connector on your Proxmox server using the generated installation command.

[Image: Create Tunnel]

Configure a Public Hostname

Add a Public Hostname for your Proxmox server.

Example:

Hostname: proxmox.example.com
Service Type: HTTPS/HTTP
URL: https://localhost:8006

Cloudflare automatically creates the DNS record and securely routes traffic through the tunnel.

Configure Cloudflare Access

Navigate to:

Zero Trust → Access → Applications

Create a new Self-Hosted Application.

Configure:

Application Name
Domain
Session Duration
Access Policies

This ensures all traffic is authenticated before reaching Proxmox.

Enable Email-Based MFA

Under Access Policies, require authentication using:

One-Time Passcode (OTP)
Allowed Email Addresses

Only authorized users can proceed to the Proxmox login screen after successfully completing email verification.

Verify Secure Remote Access

Access your configured domain from another network.

Cloudflare should first display an authentication page.

After successful email verification, you'll be redirected securely to the Proxmox Web UI.

Security Benefits

Using Cloudflare Zero Trust significantly improves security compared to traditional port forwarding.

Advantages include:

No exposed public ports
Hidden origin server
Identity-based authentication
Email verification
Encrypted traffic
Access logging
Easy policy management

This approach dramatically reduces the attack surface of your home lab.

Common Use Cases

This setup works well for:

Home Labs
Self-hosted servers
Remote administration
Virtualization hosts
Development environments
Internal business infrastructure

For my personal home lab and freelance environments, I prefer Cloudflare Tunnel over exposing ports through my router. Combined with Cloudflare Zero Trust and email-based MFA, it provides a secure, reliable, and easy-to-manage solution for remote access without requiring a VPN or opening firewall ports.

Conclusion

Combining Proxmox, Cloudflare Tunnel, and Cloudflare Zero Trust creates a secure remote management solution that protects your virtualization environment while maintaining convenient access from anywhere. By removing the need for port forwarding and adding identity-based authentication, this deployment significantly strengthens the security of any self-hosted infrastructure.