Learn Proxmox Backup Server - Network Isolation & Firewall

#Introduction

ACLs in episode 12 manage who can access — now we manage from where they can come. Backups move the largest data volumes in your infrastructure, and backup data is the most tempting target for attackers. Episode 13 builds network isolation & firewall so PBS can only be reached by those who should.

Imagine PBS like a warehouse worth the company's assets: it is not on the public road, but in a special industrial zone (storage VLAN) with a guarded gate (firewall) that only accepts deliveries from known addresses (PVE nodes), and every vehicle has its identity verified (TLS + fingerprint).

#Network Isolation

#A Separate VLAN/Storage Network

Backup traffic should not mix with production/user traffic. Best practices:

Provide a dedicated storage VLAN (e.g. VLAN 10) for the PVE ↔ PBS connection.
Separate management (web UI/SSH) into its own restricted management network (VLAN 99).
If possible, separate interfaces: one NIC for storage, one for management.

This isolation has two effects: more stable performance (backups do not compete for bandwidth with user traffic) and a smaller attack surface (PBS is only visible to certain networks).

Check PBS interfaces

ip -brief addr

#Firewall: UFW Restricting 8007

The only port that must be open is 8007 (API/web UI) — and only for legitimate sources: PVE nodes and client hosts. Use UFW:

Set up the UFW firewall on PBS

ufw default deny incoming
ufw allow from 10.0.10.0/24 to any port 8007   # PVE nodes & clients
ufw allow from 10.0.99.0/24 to any port 8007   # management network
ufw allow from 10.0.99.0/24 to any port 22     # ops SSH (optional)
ufw enable

ufw default deny incoming blocks all incoming connections except those explicitly allowed. Port 8007 only accepts connections from the storage and management subnets. Verify:

Check firewall status

ufw status verbose

Warning

Make sure you open access from the management network before ufw enable, and do not drop an active SSH connection until a new connection from the correct rule is tested. A wrong rule = PBS totally locked out in the middle of the night.

#TLS: Valid Certificates & Fingerprints

#Valid Certificates (Let's Encrypt/PKI)

PBS defaults to a self-signed certificate. For production, replace it with a valid certificate so clients do not rely on "ignore the warning":

Let's Encrypt (ACME): free, suitable if PBS has a public domain that can be verified.
Internal PKI: certificates from the company CA (e.g. Vault/OpenBao) — suitable for closed networks.

ACME configuration is done in the web UI: Administration → Certificates → ACME, or via proxmox-backup-manager acme .... The certificate is also used by the web UI on 8007, so after it is installed, browsers no longer show warnings.

#Fingerprint Verification on the Client

Always use TLS (https) when connecting clients, and set the fingerprint explicitly so the client rejects unrecognized servers:

View the PBS fingerprint (on the server)

proxmox-backup-manager cert info

The same fingerprint is filled in when registering storage in PVE (episode 4) and when connecting proxmox-backup-client:

Connect a client with the fingerprint

proxmox-backup-client backup etc.pxar:/etc \
  --repository https://backup@pbs@10.0.1.10:8007/store1 \
  --fingerprint AA:BB:CC:DD:...

With the fingerprint set, the connection is rejected if the server certificate changes — protection against man-in-the-middle even on internal networks. Store the correct fingerprint; a "fingerprint mismatch" indicates something is wrong (details in episode 16).

Tip

Never disable TLS --fingerprint verification to "save time" — that is equivalent to sending all backups without authentication. On a storage network, an attacker impersonating PBS would receive all your backup data.

#Closing

Key takeaways:

Isolate backup traffic into a storage VLAN; separate management and production.
UFW firewall: default deny incoming, open 8007 only from PVE nodes/clients and the management network.
Port 8007 is the only service port; SSH is opened in a limited way for operations.
Install a valid certificate — Let's Encrypt (ACME) for public domains, an internal PKI for closed networks.
Always verify the fingerprint (proxmox-backup-manager cert info) on the client side.
Never disable TLS/fingerprint verification.

In the next episode, episode 14, we will fight the biggest threat to modern backup: repository security & anti-ransomware — combining client-side encryption with append-only/immutable datastores via read-only ZFS snapshots, strengthening off-site backups, rotating keys, and auditing task logs. Ransomware must not be able to encrypt your backups too!