discussion Guide Linux Proxmox Proxmox Security Guide: Blocking Critical Ports with Firewall and IP‑Based Access Rules 2025

[CL4Y]

🔐 Proxmox Security Guide: Blocking Critical Ports with Firewall and IP‑Based Access Rules 2025​

Proxmox VE is an open-source and powerful virtualization solution. However, some service ports opened by default are exposed to the public. These ports increase the attack surface. That’s why it’s very important—for both server security and resource protection—to close unnecessary ports and allow access only from specific IP addresses.

In this guide, we will detail how to restrict ports using the Proxmox firewall system and how to create IP-based rules.

---

📋 Important Ports Used by Proxmox​

Below is a list of key ports used by Proxmox VE’s core services:

Port	Protocol	Description
8006	TCP	Web interface (HTTPS)
5900–5999	TCP	VNC Web console
3128	TCP	SPICE Proxy
22	TCP	SSH access
111	UDP	rpcbind (used by some services)
25	TCP	Sendmail (outgoing email)
5405–5412	UDP	Corosync (cluster traffic)
60000–60050	TCP	VM live migration

---

🛡️ Enabling Proxmox’s Firewall Feature​

Proxmox includes a built-in firewall feature that allows you to define rules specific to your server.

Step 1: Enable the Firewall Feature​

• Log into the Proxmox Web Interface (https://YOUR_IP:8006)
• From the left menu, go to Datacenter > Firewall > Options
• Enable the Enable Firewall option

Doing this enables the firewall at the datacenter level. You also need to enable it at the node level and optionally for individual VMs.

---

🧱 Closing Specific Ports or Allowing Only a Certain IP​

Step 2: Add Rules​

Example: Allow only your IP address to access port 8006 (web interface):

• Go to Datacenter > Firewall > Add (add a new rule)
• Direction: IN
• Action: ACCEPT
• Source: YOUR_IP_ADDRESS
• Destination: SERVER_IP_ADDRESS
• Dest. port: 8006
• Protocol: tcp

Then Block All Other Traffic:​

• Add another rule:
  • Direction: IN
  • Action: DROP
  • Destination: SERVER_IP_ADDRESS
  • Dest. port: 8006
  • Protocol: tcp

This way, only your IP address can access the web panel port, and all other requests will be denied.

---

After installing Proxmox VE, security configurations must not be overlooked. With firewall rules, you can:

• Close unnecessary ports
• Define access only for trusted IPs
• Keep cluster-specific ports open only on relevant networks

By doing so, you not only protect against external attacks but also prevent unnecessary traffic, improving performance.

Also note: It's important to close **all** ports listed in Important Ports Used by Proxmox as outlined in the earlier section.

 

[CL4Y]

You can create a topic for the issues you are experiencing. 🙂