Zelogx MSL Setup - Operation Guide

Zero-Trust Proxmox Multi-Project Secure Lab Setup — Powered by Pritunl VPN

Table of Contents

1. VM Creation Requirements
2. VPN User Management
3. Additional Configuration
4. Important Security Note

1. VM Creation Requirements

Network Interface Configuration

When creating a VM, the network interface card (NIC) must be connected to the appropriate project-specific virtual network.

Required Steps:

1. In the Proxmox GUI, navigate to the VM creation wizard
2. Go to the Network tab
3. Select the appropriate Bridge: vnetpjXX (where XX is your project ID: 01, 02, etc.)
4. Other network settings can be configured as needed

Example:

• For Project 01: Select vnetpj01
• For Project 02: Select vnetpj02

2. VPN User Management

The following instructions assume that Organizations corresponding to each project (pj01, pj02, …, pj08) have already been created.

2.1. Adding VPN Users to Pritunl

Steps:

1. Navigate to Users → Add User
2. Fill in the user information:
   • Name: User identifier (required)
   • Select an organization: pjXX (specify the project number the user will access)
   • Email: Optional (used as a memo in OSS Pritunl)
   • Pin: Optional (additional security)

2.2. Distributing VPN Client Configuration

Method 1: Direct Download

1. Go to Users in the Pritunl interface
2. Click the download icon (↓) next to the user’s profile
3. Download the configuration file (username.tar)
4. Send the configuration file to the user via secure email

Method 2: Temporary Link (Recommended for external users)

If your Pritunl GUI is publicly accessible (e.g., via Cloudflare):

1. Click “Get temporary profile links”
2. Copy the temporary URL (expires after 24 hours)
3. Send only the URL to the user via email
4. The user can download the configuration themselves

2.3. Email Template for User Distribution

Subject: VPN Configuration for Project XX Development Environment

Dear [User Name],

Please find attached your OpenVPN client configuration file for accessing 
Project XX development environment.

Installation Instructions:
1. Download and install one of the following VPN clients:
   - OpenVPN Client: https://www.openvpn.jp/download/
   - Pritunl VPN Client: https://client.pritunl.com/#install

2. Import the attached configuration file into your VPN client

Note: Pritunl VPN client supports both OpenVPN and WireGuard protocols. 
WireGuard generally offers better performance than OpenVPN.

Best regards,
[Your Name]
Zelogx Team

3. Additional Configuration

3.1. Adding Multiple NICs to a VM

General Guidelines:

• ✅ Safe: Connecting additional NICs to Linux bridges (without routers) is generally safe
• ⚠️ Caution Required: Connecting to other vnetpjXX networks requires proper understanding
• ❌ Do Not Connect to:
  • vmbr0 (main management network)
  • vpndmzvn (VPN DMZ network)
  • Other project networks (vnetpjXX with different project IDs)

Important Security Considerations:

When connecting to custom vnets, ensure proper firewall rules are configured to prevent unauthorized access to vnet gateways. Failure to do so may expose Proxmox GUI/CLI access to VPN users.

3.2. Firewall Configuration for Nested PVE

For VMs Running Nested Proxmox VE:

1. In the Proxmox GUI, navigate to:

   Datacenter → <Host> → <VM ID> → Firewall

2. Change MAC Filter setting:

   MAC filter: Yes → No

Why This is Required:

Leaving MAC filter enabled prevents:

• Nested guest VMs from accessing the internet
• Mainland network from accessing nested guest VMs

3.3. Pritunl Organization Best Practices

Important Design Principle:

⚠️ Do not use actual company names for Organizations

Reason:

Pritunl assigns Organizations to VPN Servers, not individual users. This means:

• You cannot assign specific users within an Organization to specific servers
• All users in an Organization have access to all servers that Organization is attached to

Recommended Approach:

Use Project IDs as Organization names for 1:1 mapping:

Architecture Overview:

Pritunl VPN Server → Development Network Mapping:
├── Server01 → vnetpj01
├── Server02 → vnetpj02
├── ...
└── Server08 → vnetpj08

Example Configuration:

Adding New Organizations:

If you need additional Organizations:

1. Navigate to Users → Add Organization
2. Enter the Organization name (use Project ID for clarity)
3. Assign the Organization to the appropriate VPN Server

4. Important security note: Always enable MFA for new users

In the 2025 ransomware incident at ASKUL, attackers reportedly used stolen VPN credentials from a contractor to access the corporate network, then disabled endpoint protection (EDR), moved laterally between servers, encrypted systems, and deleted backups. This shows that even if your servers are hardened, once a client PC is compromised and plain-text credentials are stolen, VPN and admin accounts can be abused to take over the entire environment.

To minimize the impact of this class of incident, we strongly recommend enabling multi-factor authentication for both the Proxmox GUI and the Pritunl VPN portal whenever you onboard a new user.

Proxmox has built-in support for multi-factor authentication (MFA). For example, if you want to use Google Authenticator, you can configure it as follows:

• Go to: Proxmox → Datacenter → Permissions → Two Factor → [Add] → TOTP
• Select the user you want to enable MFA for; a QR code and SECRET will be displayed.
• On your smartphone, open Google Authenticator and scan the QR code or type the SECRET.
• Enter the 6-digit code shown in Google Authenticator into the Proxmox dialog and click [Add].

Pritunl also has built-in support for multi-factor authentication (MFA):

• Go to: Pritunl → Servers → [Select server] → [Stop]
• Then: Pritunl → Servers → [Select server] → [Settings]
• Check “Enable Google Authenticator” and click [Save].
• Start the server again: Pritunl → Servers → [Select server] → [Start].
• Go to: Pritunl → Users → [Select user], then click the QR-code icon.
• Provide the client with the VPN profile and the QR code (or TOTP secret) securely.

With MFA enabled, stolen IDs and passwords alone are no longer enough to log in. When you onboard a new user, treat MFA as mandatory, not optional.

Note
The Proxmox and Pritunl MFA settings described here do not provide perfect protection against ransomware. If a client PC is fully compromised, even a combination of VDI, EDR, DLP, UTM and other layered defenses cannot realistically reduce the risk to zero.
However, enabling MFA as described above can help reduce the blast radius of an incident and make it significantly harder for attackers to perform unauthorized logins and lateral movement.

Support

For questions or issues regarding this setup, please contact:

📧 Email: [email protected]

Last Updated: December 2025 Document Version: 1.0