Ports & Network
PegaProx Server Ports (Inbound)
These ports must be accessible by users connecting to PegaProx:
- Main API & Web UI
HTTPS (configurable)
- VNC WebSocket
noVNC Console
- SSH WebSocket
Node Shell / xterm.js
- HTTP Redirect
Optional (requires root)
Proxmox Node Ports (Outbound)
PegaProx needs access to these ports on all Proxmox nodes:
- Proxmox API
Required – HTTPS
- SSH Access
Recommended – Node Shell
- SPICE Proxy
Optional – SPICE Console
5900+
VNC Direct
Optional – Direct VNC
Port Calculation: VNC and SSH WebSocket ports are automatically calculated as main_port + 1 and main_port + 2. If you change the main port to 8443, VNC will be on 8444 and SSH on 8445.
Port Overview Table
| Port | Protocol | Service | Description |
|---|---|---|---|
5000 |
HTTPS | Main Server | REST API, Web UI, WebSocket events |
5001 |
WSS | VNC Proxy | noVNC WebSocket for VM consoles |
5002 |
WSS | SSH Proxy | xterm.js WebSocket for node shells |
80 |
HTTP | Redirect Server | Redirects HTTP → HTTPS (optional) |
1514 |
UDP + TCP | Syslog receiver | Integrated syslog server for your nodes and network gear. On by default; switch it off under Settings → Syslog if you do not use it. It is unauthenticated, so allow it only from your senders. |
Other outbound connections
Depending on what you connect, PegaProx also needs to reach:
| Target | Port | Used for |
|---|---|---|
| Proxmox Backup Server | 8007 (HTTPS) |
PBS integration |
| ESXi hosts | 443 (HTTPS), 22 (SSH) |
ESXi inventory, consoles and migrations |
| XCP-ng pools | 443 (HTTPS) |
XCP-ng management |
| Other PegaProx instances of a group | their main port (default 5000) |
PegaProx High Availability: sync and forwarded changes, both directions (from 1.3) |
Required Access to Proxmox Nodes
Important: PegaProx needs network access to your Proxmox nodes. Make sure the following ports are open from the PegaProx server to all Proxmox nodes.
| Port | Protocol | Service | Required For |
|---|---|---|---|
8006 |
HTTPS | Proxmox API | Required – All API operations, VM management, monitoring |
22 |
SSH | SSH Access | Recommended – Node shell, advanced operations, file transfers |
3128 |
HTTP | SPICE Proxy | Optional – SPICE console connections |
Network Diagram
👤 Users
Browsers
🖥️ PegaProx
:5000, :5001, :5002
📦 Proxmox Nodes
:8006 (API) + :22 (SSH)
Inbound to PegaProx: 5000, 5001, 5002 (from users) | Outbound from PegaProx: 8006, 22 (to Proxmox nodes)
Firewall Configuration
🔓 Inbound Rules (PegaProx Server)
Allow users to access PegaProx:
UFW
# Allow PegaProx ports (inbound)
sudo ufw allow 5000/tcp # Main API & Web UI
sudo ufw allow 5001/tcp # VNC WebSocket
sudo ufw allow 5002/tcp # SSH WebSocket
# Optional: HTTP redirect
sudo ufw allow 80/tcp
🔒 Outbound Rules (to Proxmox Nodes)
PegaProx needs access to your Proxmox cluster:
UFW
# Allow access to Proxmox nodes (outbound)
# Usually outbound is allowed by default
# On Proxmox nodes, allow from PegaProx:
sudo ufw allow from PEGAPROX_IP to any port 8006
sudo ufw allow from PEGAPROX_IP to any port 22
Proxmox Firewall: If you use the Proxmox built-in firewall, make sure to allow connections from the PegaProx server IP on ports 8006 (API) and 22 (SSH) on the datacenter or node level.
Self-Signed Certificates: When using self-signed certificates, users must accept the certificate on all three ports (5000, 5001, 5002) separately in their browser. The VNC and SSH consoles won't work until the certificates are accepted on ports 5001 and 5002.
Reverse Proxy
PegaProx works behind nginx or other reverse proxies. See the Reverse Proxy section for a complete production configuration with WebSocket, SSE, and VNC/SSH console support.