Search the internet for reachable management interfaces and you will find thousands: iDRACs, iLOs and other BMCs, neatly parked behind a public IP address because someone once needed to reach them at night. And unlike their owners think, these interfaces are rarely hidden: usually on the standard port, with a short password that is often still the factory default. Whoever finds one can get to work. Whoever has your BMC has your server — which is why we deliver management access through a separate out-of-band network with WireGuard, so that interface never has to touch a public network at all.
Whoever has the BMC has the server
A BMC (the management chip in your server, called iDRAC at Dell and iLO at HPE) is not a peripheral but a second computer with power over the first:
- Console — screen and keyboard as if you were standing next to the rack, down into the BIOS.
- Virtual media — attach a disk image and boot the server from it. Whoever can do that installs whatever they want.
- Power — on, off, reset, outside the operating system.
On top of that, BMC firmware has a poor reputation: vulnerabilities surface with some regularity, updates appear slowly and get installed even more slowly in practice. A password is no answer to a flaw that works without one. The only sustainable rule is that a management interface is unreachable for everyone who has no business there.
A network designed for this
That is why, with us, management interfaces live in a separate out-of-band network: a network designed for exactly this purpose, fully isolated from our production environment. It does not ride along on the infrastructure that carries your data traffic; it stands next to it.
That separation works both ways. A problem in the management network cannot touch production. And more importantly: when production has an outage (a failing line, faltering equipment, a DDoS attack pressing the front door shut) management access is still there. That is what out-of-band means: the road to the console does not run through the system you are trying to rescue.
Access via WireGuard
Access to that network runs over WireGuard. You receive your own configuration with a key pair, and with it you reach only your own management interfaces; customers do not see each other. There is deliberately little to configure, and that is exactly why we chose it:
- Silent to the outside — a WireGuard endpoint does not respond to packets without a valid key. To a scanner there is literally nothing to knock on: no login page, no banner, no handshake.
- Keys instead of passwords — access is a key pair per user. Revoking is removing one peer, not e-mailing a new password around.
- A client for every platform — WireGuard is part of every modern Linux kernel and has clients for every mainstream operating system. No appliance, no agent.
If you want a label for it: this is zero trust in practice. Access does not follow from where you happen to sit on the network, but from who you demonstrably are.
What it saves you in practice
You notice the difference at the worst possible moment. The server does not come back up after an update: VPN on, console open, see what is on the screen, without getting into a car and without scheduling remote hands. A bare-metal reinstall happens through virtual media from your desk. And if you have to demonstrate under NIS2 how management access is arranged, the answer is pleasantly short: through a separated network, per named user, with keys.
Management access as it should be
Out-of-band access costs €5 per month on our colocation; not a premium tier, but the standard way we set up management access. If your management interface currently sits behind a public IP address, or you want to know what this looks like for your equipment: get in touch or request a proposal.