Only allow access to the Proxmox node and web application via a single IP.

[Zebaschtian]

Hello,

I have two Proxmox hosts in a cluster and I want to be able to access both nodes with SSH and web application only via a specific IP address.

How is this possible without causing problems with the cluster?


Thank you for your help,
Sebastian

 

[t.lamprecht]

Hi,

One way would be to could use the LISTEN_IP config from pveproxy (API) and ListenAddress config from sshd to make the daemon only listen on specific addresses.

See the reference documentation for the Proxmox VE part:
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_pveproxy_proxmox_ve_api_proxy_daemon

And the man sshd_config manual page for the SSH daemon option documentation.

Note that the PVE nodes still need to be able to talk to each other, especially via API and for some tasks still via SSH, so if they use different, e.g., private addresses be sure to also accept those also in the listening range.

Alternatively you could setup firewall rules so that there's an outgoing that's only allowed for the known good source IP ranges and the remaining ones get rejeced by a lower priority "catch all" rule.