Install Proxmox VE 9 with bridged networking

Proxmox VE 9 turns your dedicated server into a host for KVM virtual machines and LXC containers, managed from a web interface. It is based on Debian 13 “Trixie”. This guide covers installation, repositories, storage, networking for your VMs, security and backups.

Install Proxmox VE 9

• One click: choose Proxmox VE 9 when you order, or later with Reinstall in your dashboard (see Reinstall the operating system). A new Proxmox VE server is typically online about 10 minutes after payment confirmation.
• Official ISO: to choose every installer option yourself (file system, RAID level, disk layout), mount the ISO through IPMI virtual media and install from the console. On the network screen, enter the main IP, netmask and gateway shown in your dashboard.

First login and repositories

Open https://203.0.113.10:8006 (your main IP), accept the self-signed certificate warning and log in as root, realm Linux PAM standard authentication, with the password from your delivery email.

Without a subscription, the enterprise repository answers 401 Unauthorized on apt update. Proxmox VE 9 uses deb822 .sources files: add Enabled: no to /etc/apt/sources.list.d/pve-enterprise.sources (and to ceph.sources if it points to the enterprise Ceph repository), then create /etc/apt/sources.list.d/proxmox.sources:

Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

The web interface does the same under Node → Updates → Repositories. Then update, always with full-upgrade (never plain apt upgrade on Proxmox VE), and reboot if a new kernel was installed:

apt update
apt full-upgrade

The no-subscription repository suits most single hosts; Proxmox recommends the enterprise repository, with a subscription, for production.

Storage: ZFS mirror or LVM-thin

Depending on the install method, your two disks are mirrored with ZFS or with software RAID 1 (mdadm) under LVM-thin. Check which one you have:

zpool status
cat /proc/mdstat
lvs

ZFS uses RAM for its ARC cache. On new installs, the Proxmox VE installer limits it to 10% of RAM, at most 16 GiB; the current limit is in /sys/module/zfs/parameters/zfs_arc_max (0 means the ZFS default). Change it in /etc/modprobe.d/zfs.conf, in bytes, for example options zfs zfs_arc_max=17179869184 for 16 GiB; with ZFS as the root file system, run update-initramfs -u -k all and reboot afterwards. To get the other layout, reinstall from the ISO and pick the file system under Options on the target disk screen.

Networking for your VMs

Proxmox VE normally puts your main IP on the bridge vmbr0, attached to the physical port. Leave its IPv4 configuration as it is. Additional IPv4 addresses are routed to your main IP, so VMs do not join vmbr0 directly: the host routes their traffic through a second bridge.

Enable IP forwarding

cat > /etc/sysctl.d/99-forwarding.conf <<'EOF'
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
EOF
sysctl --system

Routed bridge for additional IPv4 and IPv6

In this example, the main IP is 203.0.113.10, the additional IPs (see Additional IPv4 addresses) are 198.51.100.20 and 198.51.100.21, and the /64 is 2001:db8:1234:5678::/64. Add to /etc/network/interfaces:

auto vmbr1
iface vmbr1 inet static
        address 203.0.113.10/32
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        up ip route add 198.51.100.20/32 dev vmbr1
        up ip route add 198.51.100.21/32 dev vmbr1

iface vmbr1 inet6 static
        address 2001:db8:1234:5678::2/64

vmbr1 has no physical port: it reuses the main IP as the VMs’ IPv4 gateway, and each additional IP gets a host route into the bridge. For IPv6, ::2 on vmbr1 is the VMs’ gateway, so the whole /64 is routed into the bridge. The host keeps its own address (::1 here) on vmbr0, but as a /128: change the prefix length if it is configured as a /64. Use the IPv6 gateway shown in your dashboard (fe80::1 in this example):

iface vmbr0 inet6 static
        address 2001:db8:1234:5678::1/128
        gateway fe80::1

Configure the VM

Attach the VM’s network device to vmbr1. Inside the VM, use a /32 address with the main IP as an on-link gateway, and an address from the /64 with ::2 as gateway. In an Ubuntu VM, with netplan (add your DNS resolvers under nameservers):

network:
  version: 2
  ethernets:
    ens18:
      addresses:
        - 198.51.100.20/32
        - 2001:db8:1234:5678::100/64
      routes:
        - to: default
          via: 203.0.113.10
          on-link: true
        - to: default
          via: 2001:db8:1234:5678::2

On Debian VMs with ifupdown, use address 198.51.100.20/32, pointopoint 203.0.113.10 and gateway 203.0.113.10. For separate IPv6 networks per bridge, a /56 is available free on request; see Configure your /64 IPv6 subnet.

NAT for private VMs

VMs that only need outbound access, such as build agents or internal services, can share the main IP through NAT on a private bridge:

auto vmbr2
iface vmbr2 inet static
        address 10.10.10.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up   iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE

Give these VMs addresses in 10.10.10.0/24 with gateway 10.10.10.1. To publish one service, add a DNAT rule as another post-up line, for example iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 2222 -j DNAT --to-destination 10.10.10.2:22. If you enable the Proxmox firewall on these VMs, apply the conntrack zone note from the Proxmox network documentation. An SDN Simple zone with SNAT enabled on its subnet (Datacenter → SDN) achieves the same from the web interface.

Secure the web interface

• Two-factor authentication: under Datacenter → Permissions → Two Factor, add TOTP or WebAuthn for root@pam and store the recovery keys offline. If you lose the second factor, log in over SSH or the IPMI console and run pveum user tfa delete root@pam.
• Firewall: rules at datacenter level apply to every node. Under Datacenter → Firewall, first add accept rules for TCP 8006 and 22 from your own addresses, then enable it in Datacenter → Firewall → Options. Once enabled, incoming traffic is dropped by default and only the local network may reach the web interface and SSH, so a missing rule locks you out. VMs are filtered only when you also enable the firewall on the VM and its network devices.
• Accounts: give each administrator a named user with only the roles they need, instead of sharing root@pam.

Back up your VMs

• Proxmox Backup Server 4 is available as a one-click OS. Install it on a second server, ideally in another location, and add it under Datacenter → Storage → Add → Proxmox Backup Server. Backups are incremental and deduplicated, can be encrypted on the client and verified on a schedule.
• vzdump with the backup space add-on: the backup space speaks SFTP, rsync, BorgBackup and restic. Let a backup job (Datacenter → Backup) write to local storage, then copy the archives off the server, for example nightly with rsync -a /var/lib/vz/dump/ deploy@backup.example.com:pve-dumps/.

Keep at least one copy off the host and test a restore. A ZFS mirror or RAID 1 protects against a dead disk, not against a deleted VM.

Next steps

• Plan the host with Virtualization and compare EPYC configurations on Enterprise servers.
• Watch your disks with smartctl and nvme-cli.
• Network not coming up after a change? Revert it from the IPMI console first: restore /root/interfaces.bak and run ifreload -a. Still stuck? Our engineers answer 24/7.