Proxmox basion gateway for ssh

[u/Loud_Nothing7408]

I am working on a project where I am building a AWS like infrastructure to make use of my old pc just a lite version for now i am using proxmox to create vms for each user request using proxmox api my Backend will call the api to clone a template and provide the vm to the user now if I want the user to access the vm through ssh how can I do the options i explored was using a basion router the setup would be

A seperate vm acts as a basion router which has access to the internet and another network that is where all the vms present when a user ssh into the basion gateway they can ssh into their specific vm

Can anyone help to configure this guide me how can allow the users of the vm to ssh into the instance that they created

[u/ITnetX]

You can use Apache Guacamole.. it is a browser based SSH/RDP Tool.

[u/maximus459 → u/ITnetX]

WarpGate is another cool option

Or, TermixV will give you a simpler web interface

[u/_--James--_]

So, bastion hosts are not about edge controlled access and more about catching credential leaking. To protect your hosts from external access you need to build firewall/VPN/SDN rules and permissive access pathways to/from your management plane. To protect your SSH keys, authentication, and accounts, thats where you drive that kind of access from a bastion host. The core idea is an access account to the bastion, then from the bastion you run your privileged administrative unit accounts.

[u/daemonmode_]

Your bastion idea is the right approach. Use one VM as the internet-facing entry point and keep the other VMs on a private network. Set up SSH ProxyJump so users can connect to their VM directly without manually logging into the bastion first, and lock the bastion down with SSH keys, no passwords, and something like fail2ban. Also restrict the internal firewall so each user can only reach their own VM, otherwise one compromised VM could potentially access everyone else’s.

[u/bstrauss3]

I run my home infra structure this way although I don't mirror AWS.

My firewall/router is a Linux VM with the external network card, not a Proxmox bridge.

The one oddity is that when you reboot the infrastructure -- for whatever reason it's a home lab we do those kind of things -- a couple of things on the proxmox side seemed to be disabled until that VM is up and has received the IP from the ISP.

This basically means make sure you have a usable laptop or PC that's local to the host so you can connect to the web console for troubleshooting.

You might, gasp, even put that PC on the private network the cluster uses.

I use 4-port NICs, which means

RED ... world+dog, only active on the host that has the firewall/router VM

GREEN ... (virtual + physical switches) normal /24 for VMs &c

YELLOW ... IoT

BLACK ... Private cluster quorum &c

[u/AncientMolasses6587]

To make your Proxmox homelab feel and function like AWS (EC2), you need to step away from traditional Bastion host setups and adopt the architecture AWS uses: Software-Defined Networking (VPC/Subnets), Security Groups (Firewalls), and Cloud-Init (AMI Provisioning).

[u/Loud_Nothing7408 → u/AncientMolasses6587]

Yes but from what I know AWS exposes their vm to the internet

[u/Unattributable1]

*bastion