Binding Proxmox Web interface to a specific Interface
To force Proxmox web interface to only be available on a specific interface (eg a mangement network, or VPN tool such as Zerotier/Tailscale) add the following to /etc/default/pveproxy and restart.
This example allow access from the Tailscale IP range. To add multiple ranges you will need to separate them with commas.
ALLOW_FROM="100.64.0.0/10"
DENY_FROM="all"
POLICY="allow"