Blog Inforeseau.com – Alexandre Blanc Cyber Security

Restrict access to proxmox web admin interface

When you install proxmox, you have by default access to your admin interface, usually using the following URL :

https://IP-OF-YOUR-INSTANCE:8006

This is totally fine when using an internal instance, but quite another story if you rent an online server with proxmox on it. We don’t want to let this access wide open.

While proxmox comes with a nice firewall, it doesn’t allow you to restrict access to port 8006 and 22 (obviously not to lock you out), because it won’t do this on your « local » network, but when you are on a publicly connected machine, the « local » network is internet.

Therefore, a way to restrict this access is by creating the following file /etc/default/pveproxy with the following content :

ALLOW_FROM="127.0.0.1,172.20.0.1"
DENY_FROM="all"
POLICY="allow"

Be sure to use lower case. Then restart the pveproxy service :

service pveproxy restart

And from now on, only the listed IPs have access to the admin interface.

Reference : https://vdillenschneider.fr/architecture-de-services-avec-proxmox-sur-un-serveur-kimsufi