Install Proxmox VE on a dedicated server

Proxmox VE turns a dedicated server into a host for KVM virtual machines and LXC containers, managed from a web interface or the command line. This guide covers installing it on a FlexDedi server and the configuration that matters on a machine with a public IP: repositories, updates, storage, networking, firewall and backups.

Commands target Proxmox VE 9, which is based on Debian 13 "Trixie". Where Proxmox VE 8 (Debian 12 "Bookworm") differs, the 8.x form is shown as well. Run everything as root on the host.

Choose an install method

One-click image. Proxmox VE is in the OS library alongside Ubuntu, Debian, AlmaLinux, Rocky Linux and Windows Server. Select it when you order or reinstall from the control panel, and the server comes up with Proxmox VE installed. Before creating guests, check which storage layout it uses, as described in the storage section below.

Official ISO through the KVM console. Choose this when you want to pick the filesystem, the disk layout or the exact release yourself. The HTML5 KVM console can boot any ISO, and the IPMI and KVM documentation covers attaching virtual media.

A third route, installing Debian first and adding the Proxmox packages, also works but takes more steps. It is only worth it for unusual disk layouts.

Install from the ISO

1. Download the current Proxmox VE 9 ISO from the Proxmox website and check its SHA-256 checksum against the published value.
2. Open the KVM console from the control panel, attach the ISO as virtual media, and reboot the server from it.
3. On the target disk screen, open Options and choose zfs (RAID1) with both NVMe drives selected. On four-drive servers such as Pro 64, zfs (RAID10) uses all four.
4. Set the country, time zone and keyboard, then a strong root password and an email address for alerts.
5. On the network screen, select the interface that carries the public network and enter the server's IPv4 address with its prefix, the gateway and a DNS server, as shown in your control panel. Use a fully qualified hostname such as pve1.example.com.
6. Review the summary, install, detach the ISO and reboot.

Then browse to https://YOUR_SERVER_IP:8006 and log in as root with the Linux PAM realm. The browser warns about the self-signed certificate until you replace it; the built-in ACME client can request a Let's Encrypt certificate (Datacenter → ACME, then the node's Certificates panel).

Switch to the no-subscription repository

A fresh install points APT at the enterprise repository, which needs a subscription key; without one, apt update fails with an authorization error. Hosts without a subscription use the pve-no-subscription repository instead. Proxmox recommends the enterprise repository for production, because no-subscription packages receive less testing before release.

On Proxmox VE 9, repositories use the deb822 .sources format. Add Enabled: no to the entry in /etc/apt/sources.list.d/pve-enterprise.sources, and do the same in /etc/apt/sources.list.d/ceph.sources if it points at enterprise.proxmox.com. The edited enterprise file looks like this:

Types: deb
URIs: https://enterprise.proxmox.com/debian/pve
Suites: trixie
Components: pve-enterprise
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
Enabled: no

Then add the no-subscription repository:

cat > /etc/apt/sources.list.d/proxmox.sources <<'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF

On Proxmox VE 8, repositories are one-line .list files:

sed -i 's/^deb/# deb/' /etc/apt/sources.list.d/pve-enterprise.list
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" \
  > /etc/apt/sources.list.d/pve-no-subscription.list

Comment out /etc/apt/sources.list.d/ceph.list the same way if it uses the enterprise URL. The web interface can make all of these changes in the node's Updates → Repositories panel. Without a subscription, it also shows a "No valid subscription" notice at login. The notice is informational, and patching the interface files to hide it breaks on updates.

Update the host

apt update
apt full-upgrade
pveversion
reboot   # when a new kernel was installed

Always update Proxmox VE with apt full-upgrade (or apt dist-upgrade), never plain apt upgrade. Proxmox releases regularly add or replace dependencies, and a partial upgrade can leave the host in an inconsistent state.

Storage: ZFS or LVM-thin on NVMe

The installer produces one of two layouts. With ZFS, the rpool pool holds the system and the local-zfs storage holds guest disks. With ext4 or XFS, a volume group named pve contains a thin pool, data, exposed as local-lvm. Check what you have:

pvesm status
zpool status   # ZFS installs
lvs pve        # LVM-thin installs

On a server with two NVMe drives, a ZFS mirror is the right default. It is the only local software RAID that Proxmox supports, and it detects silent corruption that a plain mirror would faithfully copy. LVM-thin on a single drive is simple and fast but has no redundancy, and Proxmox does not support running it on Linux mdadm RAID.

Since Proxmox VE 8.1, the installer limits the ZFS ARC to 10% of RAM, capped at 16 GiB. On a Pro 32 with 384 GB, that cap is 16 GiB, which leaves the rest for guests. To change it, for example to 32 GiB:

echo "options zfs zfs_arc_max=34359738368" > /etc/modprobe.d/zfs.conf
update-initramfs -u -k all                                 # required when root is on ZFS
echo 34359738368 > /sys/module/zfs/parameters/zfs_arc_max  # apply without a reboot

On four-drive servers, an alternative to RAID10 is to install the system on a two-drive mirror and give guests their own mirror on the other two. Create that pool with persistent disk IDs rather than /dev/nvme names, which can change between boots:

ls -l /dev/disk/by-id/ | grep nvme
zpool create -o ashift=12 tank mirror /dev/disk/by-id/nvme-DISK_C /dev/disk/by-id/nvme-DISK_D
pvesm add zfspool tank-vm --pool tank --content images,rootdir --sparse 1

Networking: public IP and private VLAN

After installation, /etc/network/interfaces contains a bridge, vmbr0, that carries the host's public IP on the physical port. Guests attached to vmbr0 sit directly on the public network, which only works when they have public addresses the network accepts. With the single IPv4 address included with the server, guests usually share it through NAT, while the server's /64 block provides public IPv6; see IPv6 networking for the configuration.

NAT for guests

Create a bridge with no physical port and masquerade its subnet behind the public bridge. Append this to /etc/network/interfaces:

auto vmbr1
iface vmbr1 inet static
    address 10.10.10.1/24
    bridge-ports none
    bridge-stp off
    bridge-fd 0
    post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE
    post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
    post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

The two CT --zone lines keep connection tracking correct when the Proxmox firewall is enabled for guests. Apply the change with ifreload -a, then give each guest a static address in 10.10.10.0/24 with 10.10.10.1 as its gateway. To publish a service, forward a port to a guest with a matching pair of lines in the same stanza:

    post-up   iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 8443 -j DNAT --to-destination 10.10.10.20:443
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 8443 -j DNAT --to-destination 10.10.10.20:443

If guests need their own public IPv4 addresses, additional IPv4 is available on request. Ask support whether the addresses are routed to your main IP or on-link, because that decides whether guests attach to vmbr0 directly or sit behind a routed bridge.

Private VLAN between your servers

Free private networking connects your FlexDedi servers in the same location, and internal traffic is not billed. Use it for cluster traffic, live migration, backups and replication, so none of it touches the public interface. This example assumes VLAN 100 on port eno1; substitute the interface and VLAN ID from the private networking documentation:

auto eno1.100
iface eno1.100 inet manual

auto vmbr2
iface vmbr2 inet static
    address 10.0.0.11/24
    bridge-ports eno1.100
    bridge-stp off
    bridge-fd 0

If the private network arrives untagged on a second port, put that port in bridge-ports instead. Guests on vmbr2 reach your other servers privately, and a Proxmox cluster should run its corosync traffic over this network rather than the public one. Clusters need low latency, so keep each one within a single location.

Firewall

The Proxmox firewall works at three levels, datacenter, node and guest, and is disabled by default. Before enabling it, keep an SSH session open to the host and the KVM console within reach, so a mistake cannot lock you out.

Two defaults need attention on a host with a public address. The local_network alias is detected from the host's own subnet, so on a public IP it can include addresses you do not control, and Proxmox recommends overriding it on such hosts. The management IP set lists the addresses allowed to reach the web interface and SSH. A minimal /etc/pve/firewall/cluster.fw:

[OPTIONS]
enable: 1
policy_in: DROP

[ALIASES]
local_network 10.0.0.0/24 # private VLAN, not the public subnet

[IPSET management]
203.0.113.10 # admin workstation or VPN exit

[RULES]
IN Ping(ACCEPT)

pve-firewall localnet   # shows the local network the firewall uses
pve-firewall status

Then enable the firewall per guest under Firewall → Options and allow only the ports each guest exposes. The Proxmox firewall and FlexDedi's always-on DDoS protection do different jobs: one decides which services are reachable, the other filters volumetric attacks upstream. You need both.

Backups to a second server

RAID and ZFS mirrors protect against a failed drive, not against a deleted VM, a bad upgrade or a compromised host. Back up to a different machine.

Proxmox Backup Server (PBS) is the natural target: incremental, deduplicated backups of VMs and containers, client-side encryption, verification jobs and fast restores. Install it from its ISO through the KVM console on a second server in the same location, so backups travel over the private VLAN. A Storage 264 gives it 264 TB of raw disk, and a Core 16 is enough for smaller estates. Proxmox recommends SSDs for datastores; on a hard-drive pool, a mirrored NVMe special device for metadata is the usual compromise.

In Proxmox VE, add the backup server under Datacenter → Storage → Add → Proxmox Backup Server with its private address, the datastore name, a dedicated backup user and the server's certificate fingerprint. Schedule jobs under Datacenter → Backup. A one-off backup from the shell:

vzdump 100 --storage pbs1 --mode snapshot

For an off-site copy, run a sync job from a second PBS in another location. Private networking stops at the location boundary, so that copy crosses the public network over TLS; enable client-side encryption if the remote site should not be able to read it. Traffic is unmetered, so replicating backups between regions adds no transfer fees. Finally, test restores: a backup you have never restored is a hypothesis.

Run it on FlexDedi

Pro 32 ($749/mo) makes a capable first Proxmox host: 32 cores, 384 GB of DDR5-6000 ECC across 12 channels, and 2 × 3.84 TB NVMe Gen5 for a ZFS mirror. Pro 64 ($1,349/mo) doubles the cores and has 768 GB of RAM, four NVMe drives for ZFS RAID10 and 2 × 25 Gbps ports. Core 16 ($299/mo) runs a lab or a handful of VMs. Pair any of them with Storage 264 ($699/mo) as the backup server, and see private cloud for multi-node designs.