{"url":"https://nexovirt.com/features/vpn","title":"Proxmox WireGuard VPN in one click · NexoVirt","description":"Switch on a WireGuard VPN per Proxmox node from the panel: named configs for admins, project-only configs and customer devices that reach only their servers.","markdown_url":"https://nexovirt.com/features/vpn.md","sections":[{"heading":"Proxmox WireGuard VPN in one click","content":"NexoVirt sets up a WireGuard VPN on each Proxmox node with one click and gives every admin named configs that reach the nodes and their private networks. Configs can also be limited to one node or to selected SDN projects, and on Enterprise customers add their own devices that reach only their own servers.\n\n[Install free](https://docs.nexovirt.com/getting-started/installation/) [Read the WireGuard VPN guide](https://docs.nexovirt.com/guides/vpn/)\n\n![WireGuard VPN in the NexoVirt panel](https://nexovirt.com/assets/img/screenshots/vpn-light.webp?v=1792068738)"},{"heading":"What it does","content":"A WireGuard VPN per node, named admin configs, project and customer configs.\n\n- ### One switch per node\n\nTurn the VPN on from the node page (Network, WireGuard VPN). The agent installs WireGuard and creates the node key on the node; the private key never leaves it.\n- ### Subnets that never collide\n\nEach node gets the next free /24 in 10.88.0.0/16, or a private range you choose. Overlaps with existing networks, IP zones, SDN or NAT are refused with a clear message.\n- ### Named configs\n\nCreate as many configs as you need: a master config for every node, a config for one node, or one that reaches only selected SDN project networks. Download it or scan the QR code.\n- ### Readiness checklist\n\nEach node shows whether the agent, WireGuard, the interface, IP forwarding, the firewall and the public endpoint are ready, and the last handshake.\n- ### Customer devices\n\nOn Enterprise, customers add their own devices in the portal (5 each by default). A device reaches only the customer's own servers and follows ownership changes automatically.\n- ### Keys shown once\n\nThe panel keeps public keys only, plus an encrypted preshared key per device. A config is shown once; downloading it again creates new keys and revokes the old ones."},{"heading":"Why not just use the Proxmox web UI?","content":"Proxmox VE runs the virtualization. NexoVirt adds the layer around it. WireGuard VPN, task by task:\n\n| Task | Proxmox web UI | NexoVirt |\n|---|---|---|\n| Set up WireGuard | Install packages and write configs on each node by hand | One switch per node |\n| Pick a VPN subnet | Check every network yourself | Next free /24, overlaps refused |\n| Let a customer reach only their VMs | Firewall rules per customer by hand | Rules generated from guest ownership |\n| Node with a changing IP | Run your own DynDNS | The free nxvdns.link name is the endpoint |"},{"heading":"How to use it","content":"Up and running in 4 steps, all in the panel.\n\n1. On a node page, open Network and switch on WireGuard VPN.\n2. Open VPN in the sidebar, create a config and download it or scan its QR code with the WireGuard app.\n3. Check the readiness list on the node; behind NAT, forward the UDP port it shows.\n4. On Enterprise, customers add their own devices in the portal.\n\n[WireGuard VPN: step-by-step guide in the docs](https://docs.nexovirt.com/guides/vpn/)"},{"heading":"See it in the panel","content":"Real screenshots from NexoVirt, with demo data.\n\n![A node's VPN: status, subnet, forwarded networks, readiness checklist and devices.](https://nexovirt.com/assets/img/screenshots/vpn-node-light.webp?v=1792068738)\n\nA node's VPN: status, subnet, forwarded networks, readiness checklist and devices.\n\n![The node's Network tab: VPN, NAT, SDN and its DynDNS name.](https://nexovirt.com/assets/img/screenshots/dyndns-node-light.webp?v=1792068738)\n\nThe node's Network tab: VPN, NAT, SDN and its DynDNS name."},{"heading":"WireGuard VPN FAQ","content":"What if my Proxmox node is behind NAT?Forward the WireGuard UDP port (51820 by default) to the node. The readiness checklist shows the exact rule to add on your router.\n\nCan customers reach the Proxmox node through the VPN?No. Customer devices reach only the servers they own. The node and the panel stay out of reach.\n\nWhat do clients connect to?The node's free DynDNS name when DynDNS is on, otherwise an endpoint you set or the node's address."},{"heading":"Related pages","content":"- [ Proxmox customer portal Where customers manage their devices. ](https://nexovirt.com/proxmox-customer-portal)\n- [ DynDNS names A free nxvdns.link name per node that follows its public IPv4 and IPv6. ](https://nexovirt.com/features/dyndns)\n- [ Networking & IPAM IP pools, NAT and port forwarding, firewall inspection and a network map. ](https://nexovirt.com/features/networking)\n- [ SDN projects SDN templates and projects: a VNet, subnet and IP pool per project. ](https://nexovirt.com/features/sdn)\n- [ All features Everything NexoVirt adds to Proxmox VE. ](https://nexovirt.com/features)"},{"heading":"Start running NexoVirt today","content":"Free for homelabs with unlimited VMs on up to 2 nodes. Running a hosting business? Upgrade in place when you grow, no migration.\n\n[Install free](https://docs.nexovirt.com/getting-started/installation/) [See pricing](https://nexovirt.com/pricing)"}],"faq":[{"question":"What if my Proxmox node is behind NAT?","answer":"Forward the WireGuard UDP port (51820 by default) to the node. The readiness checklist shows the exact rule to add on your router."},{"question":"Can customers reach the Proxmox node through the VPN?","answer":"No. Customer devices reach only the servers they own. The node and the panel stay out of reach."},{"question":"What do clients connect to?","answer":"The node's free DynDNS name when DynDNS is on, otherwise an endpoint you set or the node's address."}]}