# Your Proxmox cluster as a live map

> Every Proxmox VE node, VM, container, bridge and storage on one live map: a monthly cost on each VM, idle guests and firewall gaps flagged, and changes you confirm first.

VizTopo is a web console that reads your Proxmox VE cluster through its API and draws it on one live canvas: each node with its bridges and storage, and every VM and LXC container where it runs. It puts a monthly cost on each guest at rates you set, flags stopped and idle guests that hold hardware, finds firewall gaps, and lets you start, shut down, reboot, clone or move a VM to another bridge after a check and your confirmation. It reads with an API token that can't change anything, and it never deletes anything.

## What VizTopo shows from your Proxmox VE

Connect any node and VizTopo reads the whole cluster through it, then keeps the canvas up to date as things change.

- **Nodes, bridges and storage** as containers on the canvas, with the guests inside them.
- **VMs and containers** with their status, vCPUs, memory, disks, network cards and tags. IP addresses come from the QEMU guest agent.
- **Several clusters and AWS together:** every Proxmox connection and AWS account in a workspace on one canvas, and in one search by name, IP, node or tag.

![The VizTopo canvas: an AWS region, VPC and subnets with instances inside, and below it a Proxmox cluster with its node, networks, VMs and storage](https://viztopo.com/landing/canvas.png)

## What each VM costs, and what's wasted

Proxmox has no prices, so VizTopo uses yours: a monthly rate per vCPU and per GiB of memory and disk, set once for the workspace. Every VM and container then shows what it costs a month, and so does each node and cluster on the canvas.

VizTopo flags guests that hold hardware without doing anything:

- Stopped VMs and containers that still hold their disks
- VMs and containers that have sat under 5% CPU for hours

## Firewall and exposure findings

- **The datacenter firewall is off:** Proxmox filters nothing, whatever the guests' own rules say.
- **A VM with a public IP that Proxmox doesn't filter.**
- **Network cards the firewall skips:** a card with its firewall option off isn't filtered, even when the VM's firewall is on.

Each finding sits on the card it's about, with the fix.

## Careful changes from the map

- Start, shut down and reboot VMs and containers
- Move a VM's network card to another bridge
- Clone a VM
- Open or close a port in a guest's Proxmox firewall

Each connection is read-only until someone allowed to use Control mode turns on write mode for it, by typing its name. Before anything runs, VizTopo checks that the token allows it, shows exactly what will change and waits for your confirmation. Each action can be set to Allow, Ask every time or Deny, and every change is in the audit log. VizTopo can't delete a VM, container, disk, snapshot or network.

## Consoles and schedules

Open a VM's screen or a container's terminal inside VizTopo, through the Proxmox API, with copy and paste between your computer and the guest. Or open the Proxmox web UI at that guest.

Schedules start, turn off and reboot VMs on a timetable in your time zone: business hours on weekdays, nights and weekends off, a weekly reboot window, or a multi-tier app started in order. Each run goes through the same checks as a click.

## What VizTopo needs from your Proxmox

- An **https address viztopo.com can reach** from the internet: a public IP or name, on port 8006 or a port you choose. Let only VizTopo's server address through your firewall; it's shown when you add the connection.
- A **privilege-separated API token** with Proxmox's built-in **PVEAuditor** role, granted to the token and to its user. It can read, and nothing else.
- A way to **verify the certificate**: its SHA-256 fingerprint, the cluster's CA, or a publicly trusted certificate. VizTopo never skips the check.
- For changes, a few more privileges in small roles, only if you want them.

Every command, step by step: [Connect Proxmox VE](https://viztopo.com/docs/connect-proxmox).

## VizTopo and the Proxmox web UI

VizTopo doesn't replace the Proxmox web UI: you still create VMs and containers and manage storage, backups, high availability, users and updates there. VizTopo is for seeing everything at once, knowing what it costs, finding waste and exposure, and making a few common changes with checks, confirmations and a record.

|  | Proxmox web UI | VizTopo |
| --- | --- | --- |
| Create VMs and containers; storage, backups, HA, users | Yes | No (it can clone a VM) |
| Nodes, bridges, storage and guests | A resource tree | A live map |
| Monthly cost of each VM, at your rates | No | Yes |
| Stopped and idle guests flagged as waste | No | Yes |
| Firewall gaps flagged on the guest | No | Yes |
| Proxmox clusters and AWS accounts side by side | No | Yes |
| Start, stop, clone, change networks, open ports | Yes | Yes, checked and confirmed |
| Allow / Ask / Deny per action | No | Yes, on top of Proxmox's permissions |

## Questions

### Does VizTopo replace the Proxmox web UI?

No. You still create guests and manage storage, backups, HA, users and updates in Proxmox. VizTopo shows the whole cluster (and your AWS) on one map with costs, waste and security findings, and makes a few common changes with checks and confirmations.

### What Proxmox permissions does VizTopo need?

To read: a privilege-separated API token with the built-in PVEAuditor role on /, granted to the token and to its user. For changes, small extra roles: VizTopoPower (start, shut down, reboot), VizTopoNetwork (network cards and firewall ports), VizTopoClone (clone) and VizTopoConsole (screens and terminals). The [guide](https://viztopo.com/docs/connect-proxmox) has the commands.

### Does it see the whole cluster from one node?

Yes. Connect any node, and VizTopo reads every node, guest, bridge and storage in the cluster through it.

### Which Proxmox VE versions does it work with?

VizTopo's setup commands and permission checks are written for Proxmox VE 8 and 9, whose privileges differ a little: on 8, VM IP addresses take one more privilege.

### Can VizTopo delete my VMs?

No. It has no action that deletes a VM, container, disk, snapshot or network, and its read-only token couldn't anyway.

### Why does my Proxmox have to be reachable from the internet?

viztopo.com calls the Proxmox API from its own server. Expose only the API port, let only VizTopo's server address through your firewall, and give the token only the privileges it asks for. Private and local addresses are refused.

---

Source: https://viztopo.com/proxmox (updated 2026-10-21). Start free: https://viztopo.com/signup