NBP file downloaded successfully / failed to load Boot / Access Denied is Secure Boot refusing to run the iPXE binary. Turn off Secure Boot in your UEFI settings and it’ll boot.
Why Secure Boot blocks iPXE
iPXE is an open-source network boot firmware. The binaries most people use aren’t signed with a key that’s in the default Secure Boot database. So when the UEFI tries to load the NBP (Network Boot Program) it downloaded from your TFTP server, it checks the signature, finds nothing it trusts, and throws Access Denied. It’s not a Proxmox issue, it’s not your DHCP config. It’s just Secure Boot doing its job.
The fix
Get into your UEFI setup. On most boards that’s F2 or Del during POST, but check your manual. Then find Secure Boot and disable it.
The exact path varies by vendor, but it’s usually under a Security or Boot tab. Look for Secure Boot and set it to Disabled. On some boards you have to clear the Secure Boot keys first, or set an admin password before the option unlocks. Annoying, but that’s how it is.
Save and exit. Boot from the network again. The NBP should load now, and you’ll get the Proxmox installer menu instead of the error.
If it still fails
Check that the NBP file is correct. For UEFI PXE boot you need ipxe.efi or a similar EFI binary, not the legacy undionly.kpxe. If you’re using dnsmasq or a proxyDHCP setup, make sure the filename option points to the right file. But 9 times out of 10, this error is Secure Boot.
If you’re setting up PXE boot for Proxmox, you might also want to look at importing a ready-made .img as an ISO as an alternative to network booting.
My take
Secure Boot is a pain in the butt for homelab stuff. It’s meant for Windows and signed bootloaders, and it just gets in the way when you’re trying to netboot your own server. I’d disable it and leave it off unless you have a specific reason to keep it on. If you do need Secure Boot, you’d have to sign your iPXE binary with your own keys and enroll them in the UEFI. That’s a whole other rabbit hole.
