Help with Port Forwarding

[lucasBR5]

Hello, can someone help me with port forwarding in Proxmox VE 8.0.3? I want to configure access using my public IP address so that I can still access the virtual environment when I'm outside my network. I have set up port forwarding in my router (see images), but when I try to access it from xxx.x.xx.xxx:9000, I get a connection timeout error.

The firewall in Proxmox VE is active and only port 8006 is open on both the data center and node.

My local Proxmox connection is 192.168.0.14:8006.

What could be missing in this configuration?

(router)

 

[Dunuin]

I want to configure access using my public IP address so that I can still access the virtual environment when I'm outside my network. I have set up port forwarding in my router (see images), but when I try to access it from xxx.x.xx.xxx:9000, I get a connection timeout error.

This isn't good practice. A hypervisors management shouldn't be public. If you want to access it from outside your LAN I would highly recommend to install a VPN server on your PVE host as a VM or use your routers VPN server in case it offers this as a feature and then connect remotely to your LAN via VPN client instead of making the webUI public. I personally like to run a OPNsense VM for that with the wireguard plugin. This would also allow you to use the suricata plugin for intrusion protection and to put your public services in an insolated DMZ subnet for additional security.

The firewall in Proxmox VE is active and only port 8006 is open on both the data center and node.

Actually there are more ports open. See the hidden anti-lockout rules that always apply and overwrite your "Input Policy: Drop" unless you create a custom rule to block those port explicitly: https://pve.proxmox.com/wiki/Firewall#pve_firewall_default_rules

And update your PVE. We are on 8.1.4 and not on 8.0.3. Making it public without regularly applying security fixes makes it even worse. You already got half a year of unfixed vulnerabilities. Including unpatched SSH server vulnerabilities for remote access...

And to your actual problem. You only allow packets that come from "source port: 8006" and your router that is doing the NAT will probably send the packets from another port. So I would remove that and only keep the "destination port: 8006".

 

[lucasBR5]

This isn't good practice. A hypervisors management shouldn't be public. If you want to access it from outside your LAN I would highly recommend to install a VPN server on your PVE host as a VM or use your routers VPN server in case it offers this as a feature and then connect remotely to your LAN via VPN client instead of making the webUI public.


Actually there are more ports open. See the hidden anti-lockout rules that always apply and overwrite your "Input Policy: Drop" unless you create a custom rule to block those port explicitely: https://pve.proxmox.com/wiki/Firewall#pve_firewall_default_rules

And update your PVE. We are on 8.1.4 and not on 8.0.3. Making it public without regularly applying security fixes makes it even worse. You already got half a year of unfixed vulnerabilities.

And to your actual problem. You only allow packets that come from "source port: 8006" and your router that is doing the NAT will probably send the packets from another port. So I would remove that and only keep the "destination port: 8006".

Right, I can try to set up a VPN for a more secure access. Do you recommend any tutorials or documentation for a beginner in Proxmox learn about VPN? Additionally, one of the uses I intend for my home server is to host a container for a Valheim dedicated server, which requires port forwarding anyway, doesn't it?

 

[Dunuin]

Additionally, one of the uses I intend for my home server is to host a container for a Valheim dedicated server, which requires port forwarding anyway, doesn't it?

Yes, but it's way worse to make your hypervisor public than just a VM. If a craftsman needs access to the pipes in your basement, give him only the basement key and not the master key to your whole house and safe.
And to do it properly you usually also would put your VMs/LXCs into an isolated DMZ subnet. So in case a VM gets hacked the attacker at least wouldn't be able to access your LAN and cause more damage there.

I personally like to run a OPNsense VM for that with the wireguard plugin. This would also allow you to use the suricata plugin for intrusion protection and to put your public services in an insolated DMZ subnet for additional security.

Right, I can try to set up a VPN for a more secure access. Do you recommend any tutorials or documentation for a beginner in Proxmox learn about VPN?

You probably want something with a GUI as doing it manually on the CLI isn't that beginner friendly:
https://github.com/pirate/wireguard-docs
https://docs.opnsense.org/manual/how-tos/wireguard-client.html

I remember PiVPN being quite easy to install:
https://www.pivpn.io/

 

[_gabriel]

xxx.x.xx.xxx:9000

don't forget to put httpS:// before ip:port

You can try to forward the ssh port 22 to test.

of course, ssh or webui need behind vpn, to prevent scanners... hosting wireguard on the host itself is better than nothing.

 

[lucasBR5]

don't forget to put httpS:// before ip:port

You can try to forward the ssh port 22 to test.

of course, ssh or webui need behind vpn, to prevent scanners... hosting wireguard on the host itself is better than nothing.

Yes, but it's way worse to make your hypervisor public than just a VM. If a craftsman needs access to the pipes in your basement, give him only the basement key and not the master key to your whole house and safe.
And to do it properly you usually also would put your VMs/LXCs into an isolated DMZ subnet. So in case a VM gets hacked the attacker at least wouldn't be able to access your LAN and cause more damage there.



You probably want something with a GUI as doing it manually on the CLI isn't that beginner friendly:
https://github.com/pirate/wireguard-docs
https://docs.opnsense.org/manual/how-tos/wireguard-client.html

I remember PiVPN being quite easy to install:
https://www.pivpn.io/

Thank you for the answers, guys. I'll try to make it work in the next few days, and if I have another question, I'll be back here.