Operation Guide

Zelogx MSL Setup - Operation Guide

Zero-Trust Proxmox Multi-Project Secure Lab Setup — Powered by Pritunl VPN

Table of Contents

  1. VM Creation Requirements
  2. VPN User Management
  3. Additional Configuration
  4. Important Security Note

1. VM Creation Requirements

Network Interface Configuration

When creating a VM, the network interface card (NIC) must be connected to the appropriate project-specific virtual network.

Required Steps:

  1. In the Proxmox GUI, navigate to the VM creation wizard
  2. Go to the Network tab
  3. Select the appropriate Bridge: vnetpjXX (where XX is your project ID: 01, 02, etc.)
  4. Other network settings can be configured as needed

Example:

2. VPN User Management

The following instructions assume that Organizations corresponding to each project (pj01, pj02, …, pj08) have already been created.

2.1. Adding VPN Users to Pritunl

Steps:

  1. Navigate to Users → Add User
  2. Fill in the user information:
    • Name: User identifier (required)
    • Select an organization: pjXX (specify the project number the user will access)
    • Email: Optional (used as a memo in OSS Pritunl)
    • Pin: Optional (additional security)

2.2. Distributing VPN Client Configuration

Method 1: Direct Download

  1. Go to Users in the Pritunl interface
  2. Click the download icon (↓) next to the user’s profile
  3. Download the configuration file (username.tar)
  4. Send the configuration file to the user via secure email

Method 2: Temporary Link (Recommended for external users)

If your Pritunl GUI is publicly accessible (e.g., via Cloudflare):

  1. Click “Get temporary profile links”
  2. Copy the temporary URL (expires after 24 hours)
  3. Send only the URL to the user via email
  4. The user can download the configuration themselves

2.3. Email Template for User Distribution

Subject: VPN Configuration for Project XX Development Environment

Dear [User Name],

Please find attached your OpenVPN client configuration file for accessing 
Project XX development environment.

Installation Instructions:
1. Download and install one of the following VPN clients:
   - OpenVPN Client: https://www.openvpn.jp/download/
   - Pritunl VPN Client: https://client.pritunl.com/#install

2. Import the attached configuration file into your VPN client

Note: Pritunl VPN client supports both OpenVPN and WireGuard protocols. 
WireGuard generally offers better performance than OpenVPN.

Best regards,
[Your Name]
Zelogx Team

3. Additional Configuration

3.1. Adding Multiple NICs to a VM

General Guidelines:

Important Security Considerations:

When connecting to custom vnets, ensure proper firewall rules are configured to prevent unauthorized access to vnet gateways. Failure to do so may expose Proxmox GUI/CLI access to VPN users.

3.2. Firewall Configuration for Nested PVE

For VMs Running Nested Proxmox VE:

  1. In the Proxmox GUI, navigate to:

    Datacenter → <Host> → <VM ID> → Firewall

  2. Change MAC Filter setting:

    MAC filter: Yes → No

Why This is Required:

Leaving MAC filter enabled prevents:

3.3. Pritunl Organization Best Practices

Important Design Principle:

⚠️ Do not use actual company names for Organizations

Reason:

Pritunl assigns Organizations to VPN Servers, not individual users. This means:

Recommended Approach:

Use Project IDs as Organization names for 1:1 mapping:

OrganizationPurpose
pj01Project 01 users
pj02Project 02 users
pj03Project 03 users
……

Architecture Overview:

Pritunl VPN Server → Development Network Mapping:
├── Server01 → vnetpj01
├── Server02 → vnetpj02
├── ...
└── Server08 → vnetpj08

Example Configuration:

OrganizationUserAccess
pj01UserAAProject 01 only
pj01UserABProject 01 only
pj02UserBAProject 02 only
pj02UserBBProject 02 only
pj01, pj03UserACProjects 01 and 03

Adding New Organizations:

If you need additional Organizations:

  1. Navigate to Users → Add Organization
  2. Enter the Organization name (use Project ID for clarity)
  3. Assign the Organization to the appropriate VPN Server

4. Important security note: Always enable MFA for new users

In the 2025 ransomware incident at ASKUL, attackers reportedly used stolen VPN credentials from a contractor to access the corporate network, then disabled endpoint protection (EDR), moved laterally between servers, encrypted systems, and deleted backups. This shows that even if your servers are hardened, once a client PC is compromised and plain-text credentials are stolen, VPN and admin accounts can be abused to take over the entire environment.

To minimize the impact of this class of incident, we strongly recommend enabling multi-factor authentication for both the Proxmox GUI and the Pritunl VPN portal whenever you onboard a new user.

Proxmox has built-in support for multi-factor authentication (MFA). For example, if you want to use Google Authenticator, you can configure it as follows:

Pritunl also has built-in support for multi-factor authentication (MFA):

With MFA enabled, stolen IDs and passwords alone are no longer enough to log in. When you onboard a new user, treat MFA as mandatory, not optional.

Note
The Proxmox and Pritunl MFA settings described here do not provide perfect protection against ransomware. If a client PC is fully compromised, even a combination of VDI, EDR, DLP, UTM and other layered defenses cannot realistically reduce the risk to zero.
However, enabling MFA as described above can help reduce the blast radius of an incident and make it significantly harder for attackers to perform unauthorized logins and lateral movement.

Support

For questions or issues regarding this setup, please contact:

📧 Email: [email protected]

Last Updated: December 2025 Document Version: 1.0