Exposing PVE web interface to public internet

[promoxer]

Anyone knows if the PVE web interface has been tested sufficiently to be secured?
Do you guys expose the PVE web interface to the public internet?

Just wanted to get a sense of how you guys are setting this up.

I tend to try and do everything via HTTPS only as I often encounter places that are not SSH friendly, so I'm aware of tunnelling, but it isn't what I want.

 

[Dunuin]

Using a VPN would of cause be the most secure option, so it's not easy attackable in the first place.
If that is not an option there are some things you could do to harden security:

• Install and set up fail2ban
• Proper firewall rules (for example only allowing specific IPs to access webUI/API/SSH)
• Put a OPNsense VM with intrusion prevention system between the PVE host and the WAN
• Enable 2FA for the webUI
• Forbid SSH logins using passwords
• Set up proper monitoring (for example "aide" to identify a compromised host)
• ...

 

[promoxer]

Thanks, I think I will go for the 2FA.

My main concern was exposing it would be announcing that an instance of PVE is running here.