Port forwarding replacement

[illu133minati]

Hello all. I'm searching for a replacement for port forwarding from my router.
I have a server running on an LXC on my proxmox with a specific IP and port. I want to access that IP and port from outside. I'm told port forwarding is unsafe. I understand.
I have tried tailscale zerotier and cloudflare. All solutions are good in their purpose. But I need to access the server from it's IP and domain directly, instead of a domain name or client app.
Any ideas?

 

[_gabriel]

I'm told port forwarding is unsafe. I understand.

it seems not.
Forwarding is not about secure or not.
Forwarding is required if NAT involved and if you need to expose a service publicly.

Unsafe is exposing some services publicly like famous RDP.

 

[illu133minati]

it seems not.
Forwarding is not about secure or not.
Forwarding is required if NAT involved and if you need to expose a service publicly.

Unsafe is exposing some services publicly like famous RDP.

Ohhhhh. I read so much and saw so many videos telling me it was so insecure. So if I port forward to a dicom server on my proxmox, my patients data is secure?

 

[_gabriel]

if I port forward to a dicom server on my proxmox, my patients data is secure?

if dicom service is expected to be public AND no human error, yes.

 

[illu133minati]

if dicom service is expected to be public AND no human error, yes.

BTW, you can always secure more, with a VPN or if only some devices access your data and if they have static IPs, whitelisting their IPs with PVE firewall is best.

Ty. Great help sir

 

[_gabriel]

whitelisting their IPs with PVE firewall is best.

Sorry, this is just for PVE host ports.

When you forward port to guests with iptables, you need to use -s argument to allow forward for the only specified ip.

 

[illu133minati]

Sorry, this is just for PVE host ports.

When you forward port to guests with iptables, you need to use -s argument to allow forward for the only specified ip.

Sorry I'm again confused. It was wrong advice sir?
Plus I'm using the IP as dmz host and then port triggering. Where to add this -s?

 

[_gabriel]

sorry, my english isn't great.

edit: For Proxmox exposed publicly with NAT for its Guests like rented dedicated server :

This is only if you want whitelist autorized ip only :

Myself use PVE Firewall to whitelist autorized ip for PVE host itself (mainly port 22 and 8006)
Then forward port to guest, using iptables command line, where, often forgotten, whitelist isn't applied, so -s argument is required if you want whitelist ip apply to forward.

 

[illu133minati]

sorry, my english isn't great.

This is only if you want whitelist autorized ip only :

Myself use PVE Firewall to whitelist autorized ip for PVE host itself (mainly port 22 and 8006)
Then forward port to guest, using iptables command line, where, often forgotten, whitelist isn't applied, so -s argument is required if you want whitelist ip apply to forward.

All your help is appreciated sir. Will explore this what you have told me. Thanks

 

[_gabriel]

I'm using the IP as dmz host and then port triggering

Need clarification.
There isn't need port triggering if you define IP as DMZ , even more why port triggering when port forwarding is required ?

 

[illu133minati]

Need clarification.
There isn't need port triggering if you define IP as DMZ , even more why port triggering when port forwarding is required ?

I have a ptcl router in Pakistan. And I watched an online tutorial for port forwarding. It has 3 options which the tutorial instructed me to set. I made a virtual server with my intended port and IP, port trigger with my intended port and dmz host as my intended IP.

 

[_gabriel]

Only Virtual Server is required to do a regular port forwarding.

BTW, has nothing to do with PVE.

 

[illu133minati]

Only Virtual Server is required to do a regular port forwarding.

BTW, has nothing to do with PVE.

Oh ok. Ty. Will study more and fix it.