Binding Proxmox Web interface to a specific Interface
To force Proxmox web interface to only be available on a specific interface (eg a mangement network, or VPN tool such as Zerotier/Tailscale) add the following to /etc/default/pveproxy and restart.
This example allow access from the Tailscale IP range. To add multiple ranges you will need to separate them with commas.
ALLOW_FROM="100.64.0.0/10" DENY_FROM="all" POLICY="allow"