SPICE Port (3128) Exposed to Public Internet

[Tim Hörnle - UJAM]

While examining my system, I noticed that the SPICE port (3128) appears to be open to the public Internet by default. I'm curious if this is the default setting and if there are any potential security risks?

I know what SPICE is used for, but I am interested in improving the security of my Proxmox server without disabling essential features. Therefore, I am considering using UFW to tighten security.

Can anyone give me some guidance on how to secure the SPICE port (3128) using UFW? Are there any workarounds to maintain functionality while improving security?

 

[fabian]

https://pve.proxmox.com/pve-docs/pve-admin-guide.html#chapter_pve_firewall

The firewall is completely disabled by default, so you need to ...

 

[Tim Hörnle - UJAM]

https://pve.proxmox.com/pve-docs/pve-admin-guide.html#chapter_pve_firewall

Sure, I am aware of that. But I was wondering if it was necessary for the port to be open to the public. Or if it is even dangerous.

 

[fabian]

it's necessary to be open for systems that want to access Spice consoles - what that means for your firewall settings depends on your use case/setup.