XOA doesn't show Console over zerotier vpn

[Morpheus0x]

I have a xcp-ng host server called Thor behind a firewall. Zerotier is installed directly on the hypervisor. The Xen Orchestra instance is in a VM on a different machine and also has zerotier installed.

Everything works except for the console for the VM hosted on Thor and the hypervisor itself. Running xo-server in debug mode I get the following output after clicking on console:

2021-03-16T19:39:14.225Z xo:main INFO + Console proxy (root - ::ffff:192.168.3.4)
2021-03-16T19:39:14.488Z xo:api DEBUG root | pool.listMissingPatches(...) [8ms] ==> array
2021-03-16T19:39:15.097Z xo:api DEBUG root | pool.listMissingPatches(...) [5ms] ==> array
2021-03-16T19:39:28.506Z xo:proxy-console DEBUG error from the console: {
  error: Error: connect ETIMEDOUT 192.168.0.157:443
      at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1146:16)
      at TCPConnectWrap.callbackTrampoline (internal/async_hooks.js:131:14) {
    errno: -110,
    code: 'ETIMEDOUT',
    syscall: 'connect',
    address: '192.168.0.157',
    port: 443
  }
}
2021-03-16T19:39:41.563Z xo:api WARN root | vm.stats(...) [32s] =!> Error: connect ETIMEDOUT 10.0.2.129:443
2021-03-16T19:39:42.401Z xo:api DEBUG root | pool.listMissingPatches(...) [4ms] ==> array
  xen-api root@10.11.16.10: event.from(...) [40s] ==> object +4s
2021-03-16T19:39:44.739Z xo:api DEBUG root | pool.listMissingPatches(...) [5ms] ==> array
2021-03-16T19:39:45.658Z xo:proxy-console DEBUG error from the console: {
  error: Error: connect ETIMEDOUT 10.0.2.129:443
      at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1146:16)
      at TCPConnectWrap.callbackTrampoline (internal/async_hooks.js:131:14) {
    errno: -110,
    code: 'ETIMEDOUT',
    syscall: 'connect',
    address: '10.0.2.129',
    port: 443
  }
}
2021-03-16T19:39:45.690Z xo:main INFO - Console proxy (root - ::ffff:192.168.3.4)

192.168.3.4 is the IP of the jump host I am using to connect to the Xen Orchestra server, I don't know where 192.168.0.157 is from.
10.0.2.129 is the local IP of Thor behind the firewall, but the Zerotier IP of the same server is 10.11.2.10 which is the IP I put into the host field for the server inside xoa.

Full disclosure: I installed Xen Orchestra from this install script https://github.com/ronivay/XenOrchestraInstallerUpdater but I don't think that this is the reason it doesn't work. Also none of my servers host anything in a productive environment. This is my hobby.

How can I get the console to show up?

[olivierlambert]

1. We do not encourage to modify the dom0
2. Console IP is returned by XAPI. So check your management network IP address.