Proxmox Cloudflare Tunnel Setup

Secure access to Proxmox VE API through Cloudflare Tunnel with IP-based access control for Tines automation platform.

Overview

This setup allows you to:

• Expose Proxmox API (192.168.0.100:8006) securely via Cloudflare
• Restrict access to specific Tines SaaS IPs only
• Avoid exposing your home lab directly to the internet
• Use HTTPS with automatic SSL/TLS

Architecture

Tines (44.246.174.5, 54.70.210.130)
    ↓
Cloudflare (Firewall Rules)
    ↓
Cloudflare Tunnel
    ↓
Your Home Lab (192.168.0.100:8006)

Prerequisites

• Domain name managed by Cloudflare (e.g., sifbaksh.com)
• Cloudflare account (free tier works)
• Linux machine on your home network (for running cloudflared)
• Proxmox VE running at 192.168.0.100
• Proxmox API token or user credentials

Quick Start

# 1. Clone this repository
git clone https://github.com/seefor/proxmox-cloudflare-tunnel.git
cd proxmox-cloudflare-tunnel

# 2. Install cloudflared
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

# 3. Authenticate with Cloudflare
cloudflared tunnel login

# 4. Create tunnel
cloudflared tunnel create proxmox

# 5. Copy the example config and customize
cp config.yml.example ~/.cloudflared/config.yml
# Edit ~/.cloudflared/config.yml with your tunnel ID and credentials path

# 6. Create DNS record
cloudflared tunnel route dns proxmox proxmox.yourdomain.com

# 7. Run tunnel
cloudflared tunnel run proxmox

# 8. Install as service (optional)
sudo cloudflared service install
sudo systemctl start cloudflared
sudo systemctl enable cloudflared

Detailed Setup

Step 1: Install cloudflared

Install on a Linux machine within your home network:

curl -L --output cloudflared.deb \
  https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb
cloudflared --version

Step 2: Authenticate with Cloudflare

cloudflared tunnel login

This will:

1. Open your browser
2. Prompt you to log into Cloudflare
3. Select your domain
4. Save credentials to ~/.cloudflared/cert.pem

Step 3: Create Tunnel

cloudflared tunnel create proxmox

Save the Tunnel ID shown in the output. Credentials are saved to: ~/.cloudflared/<TUNNEL-ID>.json

Step 4: Configure DNS

Option A: Command Line

cloudflared tunnel route dns proxmox proxmox.yourdomain.com

Option B: Cloudflare Dashboard

1. Go to DNS settings
2. Add CNAME record:
   • Name: proxmox
   • Target: <TUNNEL-ID>.cfargotunnel.com
   • Proxy status: Proxied (orange cloud)

Step 5: Create Configuration File

Copy the example config:

mkdir -p ~/.cloudflared
cp config.yml.example ~/.cloudflared/config.yml

Edit ~/.cloudflared/config.yml with your details:

tunnel: <YOUR-TUNNEL-ID>
credentials-file: /home/<username>/.cloudflared/<TUNNEL-ID>.json

ingress:
  - hostname: proxmox.yourdomain.com
    service: https://192.168.0.100:8006
    originRequest:
      noTLSVerify: true
      connectTimeout: 30s
  
  - service: http_status:404

Note: noTLSVerify: true is required because Proxmox uses a self-signed certificate.

Step 6: Run the Tunnel

Test run:

cloudflared tunnel run proxmox

Install as system service:

sudo cloudflared service install
sudo systemctl start cloudflared
sudo systemctl enable cloudflared
sudo systemctl status cloudflared

Step 7: Secure with Cloudflare Firewall Rules

Create Firewall Rule

1. Go to Cloudflare Dashboard
2. Select your domain
3. Navigate to Security → WAF → Firewall rules
4. Click Create rule

Rule Configuration:

• Rule name: Allow Tines to Proxmox
• Expression:

  (http.host eq "proxmox.yourdomain.com" and not ip.src in {44.246.174.5 54.70.210.130})
  

• Action: Block

This blocks all traffic except from Tines IPs.

Tines SaaS IP Addresses

44.246.174.5
54.70.210.130

Step 8: Create Proxmox API Token

1. Log into Proxmox web interface
2. Go to Datacenter → Permissions → API Tokens
3. Click Add
4. Create token with appropriate permissions
5. Save the token ID and secret

Format: USER@REALM!TOKENID=UUID

Example: tines@pve!automation=12345678-1234-1234-1234-123456789abc

Using with Tines

HTTP Request Action

Get Proxmox Version:

{
  "method": "GET",
  "url": "https://proxmox.yourdomain.com/api2/json/version",
  "headers": {
    "Authorization": "PVEAPIToken=USER@REALM!TOKENID=UUID"
  }
}

List Nodes:

{
  "method": "GET",
  "url": "https://proxmox.yourdomain.com/api2/json/nodes",
  "headers": {
    "Authorization": "PVEAPIToken=USER@REALM!TOKENID=UUID"
  }
}

List VMs:

{
  "method": "GET",
  "url": "https://proxmox.yourdomain.com/api2/json/nodes/{node}/qemu",
  "headers": {
    "Authorization": "PVEAPIToken=USER@REALM!TOKENID=UUID"
  }
}

Start VM:

{
  "method": "POST",
  "url": "https://proxmox.yourdomain.com/api2/json/nodes/{node}/qemu/{vmid}/status/start",
  "headers": {
    "Authorization": "PVEAPIToken=USER@REALM!TOKENID=UUID"
  }
}

Store Credentials Securely in Tines

1. In Tines, go to Credentials
2. Add new credential
3. Store your API token there
4. Reference it in actions: <<CREDENTIAL.proxmox_api>>

Testing

Test Tunnel Connectivity

# From your tunnel host
curl -k https://192.168.0.100:8006/api2/json/version

# Via Cloudflare (should work from Tines IPs only)
curl https://proxmox.yourdomain.com/api2/json/version \
  -H "Authorization: PVEAPIToken=USER@REALM!TOKENID=UUID"

Verify Security

Try accessing from a non-Tines IP - you should be blocked by Cloudflare:

curl https://proxmox.yourdomain.com/api2/json/version
# Should return: 403 Forbidden or similar

Troubleshooting

Tunnel won't start

Check logs:

sudo journalctl -u cloudflared -f

Common issues:

• Incorrect tunnel ID in config.yml
• Wrong credentials file path
• Port 8006 not accessible from tunnel host

Test local connectivity:

curl -k https://192.168.0.100:8006

DNS not resolving

Check DNS record:

dig proxmox.yourdomain.com

Should return CNAME pointing to <TUNNEL-ID>.cfargotunnel.com

502 Bad Gateway

• Verify Proxmox is running
• Check if tunnel can reach 192.168.0.100:8006
• Verify noTLSVerify: true is in config

Access Blocked

• Verify Cloudflare Firewall Rule is correct
• Check if request is coming from Tines IPs
• Temporarily disable rule to test

Security Best Practices

1. Use API Tokens instead of username/password
2. Limit Token Permissions - only grant what's needed
3. Enable Cloudflare Firewall Rules - restrict to Tines IPs
4. Monitor Access Logs in Cloudflare
5. Rotate API Tokens periodically
6. Use Strong Proxmox Passwords
7. Enable 2FA on Proxmox if possible
8. Regular Updates - keep cloudflared and Proxmox updated

Advanced Configuration

Multiple Services

ingress:
  - hostname: proxmox.yourdomain.com
    service: https://192.168.0.100:8006
    originRequest:
      noTLSVerify: true
  
  - hostname: pve2.yourdomain.com
    service: https://192.168.0.101:8006
    originRequest:
      noTLSVerify: true
  
  - service: http_status:404

Add Logging

tunnel: <YOUR-TUNNEL-ID>
credentials-file: /home/<username>/.cloudflared/<TUNNEL-ID>.json

# Enable logging
loglevel: info
logfile: /var/log/cloudflared.log

ingress:
  - hostname: proxmox.yourdomain.com
    service: https://192.168.0.100:8006
    originRequest:
      noTLSVerify: true
  
  - service: http_status:404

Cloudflare Access (Alternative to Firewall Rules)

For more advanced authentication:

1. Enable Cloudflare Zero Trust
2. Create Access Application
3. Set policy to allow Tines IPs
4. Can add additional authentication layers

Files in This Repository

.
├── README.md                 # This file
├── config.yml.example        # Example tunnel configuration
├── firewall-rule.json        # Cloudflare firewall rule template
├── tines-examples/           # Example Tines stories
│   └── proxmox-api-calls.json
└── scripts/
    ├── install.sh            # Automated installation script
    └── uninstall.sh          # Cleanup script

Common Proxmox API Endpoints

Endpoint	Method	Description
/api2/json/version	GET	Get Proxmox version
/api2/json/nodes	GET	List all nodes
/api2/json/nodes/{node}/qemu	GET	List VMs on node
/api2/json/nodes/{node}/lxc	GET	List containers
/api2/json/nodes/{node}/qemu/{vmid}/status/current	GET	VM status
/api2/json/nodes/{node}/qemu/{vmid}/status/start	POST	Start VM
/api2/json/nodes/{node}/qemu/{vmid}/status/stop	POST	Stop VM
/api2/json/nodes/{node}/qemu/{vmid}/status/shutdown	POST	Shutdown VM
/api2/json/nodes/{node}/qemu/{vmid}/snapshot	POST	Create snapshot

Full API documentation: https://pve.proxmox.com/pve-docs/api-viewer/

Resources

• Cloudflare Tunnel Documentation
• Proxmox API Documentation
• Tines Documentation
• Cloudflare Firewall Rules

License

MIT License - feel free to use and modify as needed.

Contributing

Pull requests are welcome! Please open an issue first to discuss proposed changes.

Support

For issues with:

• Cloudflare Tunnel: Check Cloudflare Community or documentation
• Proxmox API: See Proxmox forums
• This Setup: Open an issue in this repository

---

Note: Replace yourdomain.com with your actual domain throughout these instructions.