Operation Manual

Zero-Trust Proxmox Multi-Project Secure Lab Setup — Powered by Pritunl VPN

Table of Contents

1. VM Creation Requirements
2. VPN User Management
3. Additional Configuration

1. VM Creation Requirements

Network Interface Configuration

When creating a VM, the network interface card (NIC) must be connected to the appropriate project-specific virtual network.

Required Steps:

1. In the Proxmox GUI, navigate to the VM creation wizard
2. Go to the Network tab
3. Select the appropriate Bridge: vnetpjXX (where XX is your project ID: 01, 02, etc.)
4. Other network settings can be configured as needed

Example:

• For Project 01: Select vnetpj01
• For Project 02: Select vnetpj02

2. VPN User Management

The initial setup creates Organizations corresponding to each project (pj01, pj02, ..., pj08).

2.1. Adding VPN Users to Pritunl

Steps:

1. Navigate to Users → Add User
2. Fill in the user information:
   • Name: User identifier (required)
   • Select an organization: pjXX (specify the project number the user will access)
   • Email: Optional (used as a memo in OSS Pritunl)
   • Pin: Optional (additional security)

2.2. Distributing VPN Client Configuration

Method 1: Direct Download

1. Go to Users in the Pritunl interface
2. Click the download icon (↓) next to the user's profile
3. Download the configuration file (username.tar)
4. Send the configuration file to the user via secure email

Method 2: Temporary Link (Recommended for external users)

If your Pritunl GUI is publicly accessible (e.g., via Cloudflare):

1. Click "Get temporary profile links"
2. Copy the temporary URL (expires after 24 hours)
3. Send only the URL to the user via email
4. The user can download the configuration themselves

2.3. Email Template for User Distribution

Subject: VPN Configuration for Project XX Development Environment

Dear [User Name],

Please find attached your OpenVPN client configuration file for accessing 
Project XX development environment.

Installation Instructions:
1. Download and install one of the following VPN clients:
   - OpenVPN Client: https://www.openvpn.jp/download/
   - Pritunl VPN Client: https://client.pritunl.com/#install

2. Import the attached configuration file into your VPN client

Note: Pritunl VPN client supports both OpenVPN and WireGuard protocols. 
WireGuard generally offers better performance than OpenVPN.

Best regards,
[Your Name]
Zelogx Team

3. Additional Configuration

3.1. Adding Multiple NICs to a VM

General Guidelines:

• ✅ Safe: Connecting additional NICs to Linux bridges (not shared with VMs from other project networks) is generally safe
• ⚠️ Caution Required: Connecting to other vnetpjXX networks requires proper understanding
• ❌ Do Not Connect to:
  • vmbr0 (main management network)
  • vpndmzvn (VPN DMZ network)
  • Other project networks (vnetpjXX with different project IDs)

Important Security Considerations:

When connecting to custom vnets, ensure proper firewall rules are configured to prevent unauthorized access to vnet gateways. Failure to do so may expose Proxmox GUI/CLI access to VPN users.

3.2. Firewall Configuration for Nested PVE

For VMs Running Nested Proxmox VE:

1. In the Proxmox GUI, navigate to:
   Datacenter → <Host> → <VM ID> → Firewall
2. Change MAC Filter setting:
   MAC filter: Yes → No

Why This is Required:

Leaving MAC filter enabled prevents:

• Nested guest VMs from accessing the internet
• Mainland network from accessing nested guest VMs

3.3. Pritunl Organization Best Practices

Important Design Principle:

⚠️ Do not use actual company names for Organizations

Reason:

Pritunl assigns Organizations to VPN Servers, not individual users. This means:

• You cannot assign specific users within an Organization to specific servers
• All users in an Organization have access to all servers that Organization is attached to

Recommended Approach:

Use Project IDs as Organization names for 1:1 mapping:

Architecture Overview:

Pritunl VPN Server → Development Network Mapping:
├── Server01 → vnetpj01
├── Server02 → vnetpj02
├── ...
└── Server08 → vnetpj08

Example Configuration:

Adding New Organizations:

If you need additional Organizations:

1. Navigate to Users → Add Organization
2. Enter the Organization name (use Project ID for clarity)
3. Assign the Organization to the appropriate VPN Server

Support

For questions or issues regarding this setup, please contact:

📧 Email: [email protected]

Last Updated: December 2025
Document Version: 1.0