Proxmox Remote Access

Hi,

In the next week I will be installing Proxmox to host Home Assistant, Plex, Windows, file server and a Torrent lxc.

Im a complete newbie to all of this but would like to know if the following is possible using openwrt as a vm.

Would Openwrt along with a vpn allow me to access my file server remotely, as if I were on my home network and also allow me access to any local web interfaces (torrent etc).

Would I be able to force certain vms / lcxs to use the openwrt vpn?

Is another option to have a container with torrent client and vpn built in along with openwrt and vpn for remote access to local network?

If so are there any guides? Hope all of that makes sense!

Running OpenWrt in a VM (not a container!) is possible, but it makes the setup a lot more complex and fragile. A lot of the configuration, including the security sensitive aspects, will effectively have to be duplicated between hypervisor and OpenWrt VM, so you really need to be familiar with your chosen hypervisor to get this done correctly.

There are basically three distinct use cases here:

  • you are full enterprise, proxmox clusters, HA and automated fail-over/ hot-migration
    this is your job, you have the resources and knowledge to 'do it properly', money is not an aspect (it's just the cost of running a business, absolute reliability is), so go for it
  • you just want to provide some subnets to your homelab, optional networks, not in the critical path, not required to retain internet access, phone access, "WLAN" and to keep your lamps working (thinking smarthome). This is a tad more than just experimenting, but you can afford for your virtual router to be off(line) for a while
    if that's what you want, have a go.
  • you are in a home environment, where the main requirement is for things to 'just work' and remain relatively easy to set up and/ or debug (temporarily replace!), if there are any issues, where your significant other and kids start getting shifty if they can't get their daily fix of $internet in the evening
    stay the heck away from virtual routers, keep it simple, physical hardware router (x86_86 is fine, bare iron), one port in/ one port out - if it breaks, replace with whatever you have (maybe at degraded performance, just enough to keep the lights on and peace in your home). Really, KISS is the only way to ensure reliability, don't try to outsmart yourself - keep it in a state where you can bootstrap your setup without having internet access.

Running a virtual router is effectively a layering violation and bootstrapping nightmare, for it to work, the hypervisor -which is part of your internal networks- needs to be up and running, but at the same time it relies on the virtual router to work to get internet access., so you have two inter-depending moving parts at play. You really don't want that, unless you have redundancy and the knowledge to maintain it (i.e., it's your job - and even there, the router/ HA setup will be on dedicated hardware or a dedicated cluster, for cabling reasons alone).

Keep the bus factor in mind, you're on a work trip for a week, internet goes down - what will the rest of your family do? If you have a physical/ bare-iron router (x86_64 or not), your family can to a manual failover to a cold spare (as mentioned, it can be an old beater, as long as it works for the basics) - as that mostly means plugging wan/ lan cables from one device into another. You really don't want them messing with your hypervisor, all the VM settings etc. just to get the phones, TV sets, mail, cat videos etc. going again.

Disclaimer: I do run OpenWrt bare-iron on an x86_64, yes I know that it has tons of wasted CPU cycles, RAM and SSD space. One WAN port in, three LAN ports out - if I had to, I can replace it with a 15 year-old TP-Link router within 5 minutes. It's a router, non-routing jobs have no place on it, keeps the attack surface as small as possible and reduces the risk of accidental misconfiguration. I'm also running OpenWrt- and other VMs (on different hardware), both for mere testing and to provide temporary internet access to lab networks (think jailed-off test networks, no internet access 99.8% of the time, but sometimes I may want to allow the clients in there to run software updates), so yeah, I do know what I'm doing with virtual routers, but they are not in the critical path, I won't lose sleep if they're down.

2 Likes