Skip to content
Choose language
العربية Azerbaijani Català 中文 Hrvatski Čeština Dansk Nederlands English Estonian Persian Français Deutsch עברית Magyar Italiano Macedonian Norwegian Português Português Română Русский Español Svenska Türkçe Українська
Get started

Product docsVirtualization & VDS

Install Proxmox VE on Debian 13 with a NAT network for guests

Turn a Debian 13 VDS or dedicated server into a Proxmox VE host the way the Proxmox wiki describes, then give guests internet access and forward ports with NAT.

  • Advanced
  • 60 min read
  • Updated
On this page
  1. Before you start
  2. Step 1: Make the host name resolve to the public address
  3. Step 2: Add the Proxmox VE repository and key
  4. Step 3: Install the kernel, then Proxmox VE
  5. Step 4: Build a NAT bridge for the guests
  6. Step 5: Create a guest and reach it
  7. Secure the host
  8. Troubleshooting
  9. Next steps

Proxmox VE is an open-source virtualization platform for KVM virtual machines and LXC containers, managed in a web interface. Besides its own installer ISO, Proxmox documents how to install it on an existing Debian 13 system, which is the way to go on a VDS. This guide follows the Proxmox wiki step by step and adds the NAT network a server with one public address needs.

Before you start

  • A Debian 13 server with nested virtualization: a VDS or nested dedicated server. On a dedicated server, choose Proxmox VE in the order form instead of installing it by hand, where your configuration offers it.
  • Memory for the host and the guests: Proxmox recommends at least 2 GB for the operating system and the Proxmox VE services, plus the memory you assign to guests. Add disk space for their images.
  • Root access over SSH, and the server's console in case the network configuration needs a fix.
  • The server's address details from your service page: IP address, prefix length and gateway. In the examples: 203.0.113.10/24, gateway 203.0.113.1, interface eth0.

Check that the extensions are there before you start:

Bash
grep -Ec '(vmx|svm)' /proc/cpuinfo

A number above 0 means the server can run KVM guests.

Step 1: Make the host name resolve to the public address

Proxmox VE needs the host name to resolve to a non-loopback address. Set a name (see hostname, time zone and time sync) and map it in /etc/hosts:

Text
127.0.0.1       localhost
203.0.113.10    pve1.example.com pve1

Verify: hostname --ip-address prints 203.0.113.10 and no 127.x address.

Step 2: Add the Proxmox VE repository and key

Work as root (sudo -i). Create /etc/apt/sources.list.d/pve-install-repo.sources:

Text
Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

Download the repository key and compare its checksum with the one the Proxmox wiki lists:

Bash
wget https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg -O /usr/share/keyrings/proxmox-archive-keyring.gpg
sha256sum /usr/share/keyrings/proxmox-archive-keyring.gpg

The wiki gives 136673be77aba35dcce385b28737689ad64fd785a797e57897589aed08db6e45 as the SHA-256 value. Stop if yours differs.

Step 3: Install the kernel, then Proxmox VE

Bash
apt update && apt full-upgrade
apt install proxmox-default-kernel
systemctl reboot

After the reboot, install the Proxmox VE packages. When Postfix asks, choose Local only unless you know you need something else:

Bash
apt install proxmox-ve postfix open-iscsi chrony

Remove the Debian kernel and os-prober, then update the boot menu:

Bash
apt remove linux-image-amd64 'linux-image-6.12*'
update-grub
apt remove os-prober

Verify: uname -r shows a kernel with pve in its name after the next reboot, and https://203.0.113.10:8006 shows the Proxmox VE sign-in page. Sign in as root with the Linux PAM realm.

Step 4: Build a NAT bridge for the guests

The Proxmox documentation's masquerading example keeps the public address on the network card and gives guests a private bridge. Proxmox VE manages the network in /etc/network/interfaces; make sure the file configures your public interface statically (copy the address and gateway from your service page), then add the bridge:

Text
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 203.0.113.10/24
        gateway 203.0.113.1

auto vmbr0
iface vmbr0 inet static
        address 10.10.10.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE

Use your own interface name instead of eth0. ifreload comes with ifupdown2, which a Debian-based installation may not have yet, and the rules need iptables. Install both, then apply the change from the console, so a mistake cannot lock you out:

Bash
apt install ifupdown2 iptables
ifreload -a

Verify: ip -brief address shows vmbr0 with 10.10.10.1/24, and SSH to the public address still works.

Step 5: Create a guest and reach it

  1. Upload an installation ISO under local › ISO Images, then Create VM. On the Network tab choose the bridge vmbr0.
  2. Install the guest and give it a static address, for example 10.10.10.10/24 with the gateway 10.10.10.1 and public DNS servers.
  3. To reach a guest service from outside, forward a port with a DNAT rule. Add it to the vmbr0 stanza, so it is created with the bridge:
Text
        post-up   iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2222 -j DNAT --to-destination 10.10.10.10:22
        post-down iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 2222 -j DNAT --to-destination 10.10.10.10:22

Run ifreload -a again; then ssh -p 2222 user@203.0.113.10 reaches the guest.

Verify: the guest can ping 1.1.1.1, and the forwarded port answers from your computer.

Secure the host

  • Allow port 8006 and SSH only from your own addresses, with the Proxmox VE firewall (Datacenter › Firewall) or your server firewall.
  • Keep the host updated with apt update && apt full-upgrade.
  • Back up guests with the built-in Backup jobs to storage outside the server; see backup strategy.

Troubleshooting

hostname --ip-address prints a 127.x address. The /etc/hosts line from Step 1 is missing or wrong; Proxmox VE services will not start properly until it is fixed.

error: bad shim signature at boot. Secure Boot rejects the Proxmox kernel. The wiki notes that installing on Debian is not supported with Secure Boot enabled.

Creating a VM fails with "KVM virtualisation configured, but not available". The extensions are not visible; see nested virtualization problems.

The server lost its network after ifreload -a. Fix /etc/network/interfaces from the console, comparing it with the address details on your service page.

Guests have no internet. Check the guest's address and gateway, that cat /proc/sys/net/ipv4/ip_forward prints 1, and that iptables -t nat -L POSTROUTING -n shows the MASQUERADE rule.

Next steps

Frequently asked questions

Should I run Proxmox VE on a VDS or a dedicated server?

On a VDS, Proxmox VE runs nested, which suits labs, training and testing. For production clusters, use dedicated servers, where the hypervisor runs directly on the hardware; Proxmox VE is one of the systems our dedicated servers offer in the order form.

Why NAT instead of bridging the public network card?

Bridging puts every guest on the public network with its own MAC address, which data center networks commonly block, and each guest would need its own public address. NAT shares the server's address and keeps the host's own connection unchanged.

Do guests get addresses automatically?

Not with the plain NAT bridge in this guide. Give each guest a static address in the 10.10.10.0/24 network with 10.10.10.1 as its gateway.

Which port does the web interface use?

8006, over HTTPS: https://your-server-ip:8006. Sign in as root with the PAM realm on a fresh installation, and limit access to the port to your own addresses.

Related guides

Generate Password

Please confirm