Seamlessly Access Proxmox SDN Virtual Machines Remotely Using Tailscale Subnet Routing

If you are a homelab owner with a remote cluster of servers running on Proxmox VE, you might have already used the Software-Defined Networking (SDN) capabilities of Proxmox VE. Isolating workloads is very clean with the help of simple SDN zone and virtual network.

But the next problem is obvious: How can you logon securely from your laptop to those isolated VMs, which are not in your home network, without opening ports to the public internet?

In this guide, I'll explain how to connect your Tailscale mesh network to a Proxmox SDN virtual network with Subnet Routing so that you can log into any VM on your private SDN easily via SSH.

The Architecture Overview

Rather than having to install the Tailscale client on each individual virtual machine, we can make our Proxmox host (or a gateway container/VM on it) a Tailscale Subnet Router.

Tailscale Network (Tailnet): Your secure overlay network, over all your personal devices.

Simple SDN Zone: Your isolated internal network (e.g., 10.10.10.0/24) in which your VMs reside.

The Bridge: Tailscale runs on the Proxmox host, which advertises the SDN subnet route, which means that traffic securely passes through the encrypted tunnel directly into your internal VMs.

The Process

The first step is to advertise the SDN Subnet on the Proxmox Host.

Log in your remote Proxmox host using SSH. If you've already installed Tailscale on the host, you must inform Tailscale to advertise the internal IP range of your SDN to your tailnet.

Execute the following command (substitute 10.10.10.0/24 with the range of your Proxmox Simple SDN network):

sudo tailscale up --advertise-routes=10.10.10.0/24

As a note, if your Tailscale daemon was already running, you can use the command tailscale set --advertise-routes=10.10.10.0/24 instead.

Next, you need to enable the IP Forwarding function in the Linux kernel.

By default, Linux will drop packets received from other networks as foreign. Your Proxmox host must be configured as a router between Tailscale (tailscale0) and your SDN bridge, so you need to set up IPv4 and IPv6 packet forwarding.

1. Make a sysctl config file for Tailsale:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf

1. Apply the changes right away:

sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Then, In the Tailscale admin console, approve the route.

For security reasons, Tailscale doesn't automatically trust nodes that start routing traffic for external subnets. You have to explicitly approve it:

Go to Tailscale Admin Console.

Find your Proxmox host in the list. If you're using a mobile device, click on the three-dot menu on the right and then on “Edit route settings.”

Check the box to Approve the advertised subnet route (10.10.10.0/24).

Finally, tell your local machine to accept routes:

For Tailscale to be able to propagate custom routes advertised by your tailnet nodes, it requires you to tell it that this is OK from your local client machine (the laptop you are connecting from).

Run this on your local machine:

sudo tailscale set --accept-routes=true

Once you have finished, you can verify your work and SSH.

The tunnel is now in use. You should now be able to ping or SSH directly into any VMs that you have in your Proxmox SDN, using their local IP address, from your local machine.

ssh username@10.10.10.55

Pro-Tip: Firewall Checks

If your connection hangs or times out, you can check that UFW or your Proxmox host's firewall are not aggressively blocking forwarding rules from the tailscale0 interface. Consider temporarily allowing traffic from Tailsace with:

sudo ufw allow in on tailscale0

Conclusion

And that's it! You now have secure, encrypted access to your virtual machines running in your isolated Proxmox SDN from anywhere in the world, developer-ready without having to punch a hole in your firewall or have to put in a complex port-forwarding rule on your home router.