VM Console Relay Architecture

Why VM console access is important

Console access allows customers and providers to recover systems when SSH, RDP or networking becomes unavailable.

• Operating system recovery
• Network troubleshooting
• Boot issue investigation
• Firewall recovery
• Provisioning validation

Relay architecture overview

VMNexor uses authenticated relay workflows between the customer interface and Proxmox console sessions.

• Customer opens console from VMNexor
• VMNexor validates ownership and permissions
• Controlled console access is prepared
• Console access is routed through VMNexor
• Customer receives isolated console access

Customer Portal → VMNexor Relay → Proxmox Console Session

Why not expose Proxmox directly

• Avoid exposing Proxmox credentials
• Avoid exposing full Proxmox UI
• Restrict customer scope
• Reduce infrastructure exposure
• Maintain platform branding and workflow control

Console relay service

VMNexor uses a dedicated console relay service for handling proxied console sessions.

• Relay-based access handling
• Temporary controlled access
• reverse proxy compatibility
• Reverse proxy compatibility
• Provider-controlled infrastructure access

Nginx and reverse proxying

Reverse proxy validation is important for stable console access.

• Validate reverse proxy compatibility
• Validate HTTPS proxying
• Validate timeout behaviour
• Validate Cloudflare compatibility where applicable

Security considerations

• Restrict console access lifetime
• Validate authenticated ownership
• Protect Proxmox API credentials
• Use HTTPS everywhere
• Restrict relay exposure

Production validation

• Validate browser console access
• Validate reconnect behaviour
• Validate multiple console access attempts
• Validate reverse proxy behaviour
• Validate firewall compatibility

VMNexor relevance

VMNexor customer console workflows are designed around infrastructure-safe relay access rather than direct hypervisor exposure.