Stop exposing your Proxmox or ESXi web UI to the internet: safer ways to reach it

A hypervisor's web interface isn't a website like any other. Whoever gets past its sign-in can stop, copy or delete every VM on the host, read their disks and change the host itself. The same goes for the ESXi Host Client, a firewall's admin pages and a NAS's web interface: each one controls everything behind it.

• They're high-value targets. Addresses on the internet are scanned constantly, and an admin page answering on a well-known port gets found. A forwarded port answers on your home connection's public address, the one a what's my IP address check shows, for anyone who tries it.
• Their flaws get found too. Vendors regularly publish advisories and patches for their management interfaces. A page that only your own network can reach gives you time to apply them.
• A password is the only thing in the way. Once the page is public, its sign-in carries the whole host's security.
• VNC is weaker still. A VNC port such as 5900 has an old password check and sends the screen and keystrokes unencrypted. It should never face any network you don't control.

A VPN you run yourself

A VPN into your home network, on your router or a small box you control, puts your laptop on the LAN, and then the web interfaces work as if you were home. It's a solid option if you're comfortable running one. It does mean one service that faces the internet and needs its own updates.

A PC at home, reached through outgoing connections

With RemoteAccessApp, the PCs in your account connect out to our relay, and so does the device you connect from, so no port is opened on your router. Open a PC on your home network from the app or from a browser, and use the Proxmox VE or ESXi web interface in that PC's own browser. The management pages never leave your network. See remote desktop without port forwarding.

SSH from the website, through one of your PCs

For the command line, sign in to the website and open a saved SSH host with a local address. Choose Through my PC, and one of your own PCs on that network, running the RemoteAccessApp Agent, opens the connection there. It's free and works for SSH hosts; the SSH session is encrypted end to end between the website and the host.

VNC only inside SSH

For a KVM guest's VNC display, keep it on the server's own loopback address and set the VNC host to go through the server's saved SSH host. The KVM and QEMU console guide shows how.

• Firewall and router admin pages: allow them from the LAN only, never on the WAN side. The pfSense and OPNsense guide covers reaching them safely.
• Sign in to hosts with SSH keys, and check each host's key fingerprint the first time you connect.
• Turn on two-step verification for your RemoteAccessApp account, and the hypervisor's own two-factor sign-in where it has one.
• Keep the hypervisors themselves updated, even though they're no longer public.

See reaching pfSense, OPNsense and router admin pages safely, and the security page for how RemoteAccessApp protects your account. For the updates themselves, the homelab maintenance night checklist goes through backups, consoles and updates one host at a time.

The app also has Connect through RemoteAccessApp server, part of Pro. That connection leaves from our server's address, shared by every RemoteAccessApp user, so it's for hosts with a public address, can't reach your home network, and is never a reason to allow-list an address. A shared address isn't a security boundary: keep a strong password or key on every host either way.

The setup details differ per platform: see Proxmox VE remote management, managing an ESXi host remotely and TrueNAS, Unraid and NAS access, or start with the guide to managing Proxmox, VMware and KVM hosts from one app. To see how a lab's terminals, consoles and web panels fit together in one list, read one app for your whole homelab.

Once nothing faces the internet, the lab still needs looking after. Our free homelab management tool page sums up what RemoteAccessApp covers for servers, VMs and PCs. When the host list keeps growing, these 5 workflows for managing many servers save time on finding hosts and repeating commands. There's more on running a lab on the RemoteAccessApp blog.