Port reference
Port 8006 (TCP) – Proxmox VE Web UI
Default HTTPS port for the Proxmox VE web management interface, controlling all virtual machines and containers on the host.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on Proxmox VE hosts; serves HTTPS, typically with a self-signed certificate, bound to all interfaces.
What is port 8006 used for?
Port 8006 is the default HTTPS port for the Proxmox VE web management interface, reached at https://host:8006/. Proxmox VE is a popular open-source virtualization platform, and this is the web dashboard administrators use to create and manage virtual machines, LXC containers, storage, backups, and the host itself. It normally ships with a self-signed certificate.
When would you open it?
Open or forward 8006 only if you run a Proxmox VE host and need to reach its web console. In practice you keep it on your home or office LAN, or reach it through a VPN, rather than forwarding it through your router to the public internet.
Is it safe to open?
This console controls every VM and container on the host, so exposing it publicly is risky; keep it on a trusted network or behind a VPN and use strong credentials. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8006
nmap -p 8006 <target>netstat -ano | findstr :8006
Test-NetConnection <host> -Port 8006lsof -i :8006
nmap -p 8006 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8006 to your device's local IP, internal port 8006, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8006/tcpsudo firewall-cmd --permanent --add-port=8006/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8006 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8006" -Direction Inbound -Protocol TCP -LocalPort 8006 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against the web login
- Cleartext/weak-cert interception and MITM on self-signed TLS
- Exploitation of Proxmox VE / API vulnerabilities for auth bypass or RCE
- Full host and VM takeover after a successful login
Hardening
- Never expose 8006 to the internet; restrict to a management VLAN, VPN, or bastion
- Use strong unique credentials, MFA/TOTP, and Linux PAM or two-factor realms
- Replace the self-signed certificate with a trusted one and verify TLS
- Apply least-privilege roles via the Proxmox permission system
- Keep Proxmox VE patched and enable the built-in firewall and fail2ban
How to block this port
sudo ufw deny 8006/tcpsudo firewall-cmd --permanent --remove-port=8006/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8006 -j DROPNew-NetFirewallRule -DisplayName "Block 8006" -Direction Inbound -Protocol TCP -LocalPort 8006 -Action Blocknmap snippet
nmap -p8006 --script ssl-cert,http-title,http-auth <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 8006 used for?
- It is the default HTTPS port for the Proxmox VE web management interface, reachable at https://host:8006/. From it an administrator controls every virtual machine, container, storage pool, and the host itself.
- Is it safe to expose port 8006 to the internet?
- No. The Proxmox UI controls all VMs and containers on the host, so a compromise is a full virtualization takeover. Restrict 8006 to a management VLAN, VPN, or bastion, enforce MFA, replace the self-signed certificate, and keep Proxmox patched.