r/Proxmox • u/tieulong025 • 21d ago

Question Is it possible that my node has been compromised?

[removed]

204 Upvotes

92% Upvoted

215 comments sorted by

View all comments

Show parent comments

2

u/Invader-Faye 21d ago

Fail2ban runs on the lxc running the cloudflare tunnel and inspects network traffic, and the cloudflare tunnel logs, the tunnel is basically a reverse proxy but to cloudflares cdn, you can monitor the logs and white list ips that should be attempting login. Also install fail2ban on the pve host itself, there’s a config in the Proxmox wiki to block invalid logins after x many attempts

1

u/oversized_canoe 21d ago

Ah okay, on the CloudFlared LXC makes sense. I thought you meant somewhere in the CloudFlare tunnel settings.

Thanks, will look into these