# Install Proxmox VE on Debian 13 with a NAT network for guests > Turn a Debian 13 VDS or dedicated server into a Proxmox VE host the way the Proxmox wiki describes, then give guests internet access and forward ports with NAT. Difficulty: Advanced **Proxmox VE** is an open-source virtualization platform for KVM virtual machines and LXC containers, managed in a web interface. Besides its own installer ISO, Proxmox documents how to install it on an existing **Debian 13** system, which is the way to go on a VDS. This guide follows the Proxmox wiki step by step and adds the NAT network a server with one public address needs. ## Before you start - A **Debian 13** server with nested virtualization: a [VDS](/guides/vds-nested-virtualization) or nested dedicated server. On a **dedicated server**, choose Proxmox VE in the order form instead of installing it by hand, where your configuration offers it. - Memory for the host and the guests: Proxmox recommends at least 2 GB for the operating system and the Proxmox VE services, plus the memory you assign to guests. Add disk space for their images. - Root access over SSH, and the server's **console** in case the network configuration needs a fix. - The server's address details from your service page: IP address, prefix length and gateway. In the examples: `203.0.113.10/24`, gateway `203.0.113.1`, interface `eth0`. Check that the extensions are there before you start: ```bash grep -Ec '(vmx|svm)' /proc/cpuinfo ``` A number above `0` means the server can run KVM guests. ## Step 1: Make the host name resolve to the public address Proxmox VE needs the host name to resolve to a non-loopback address. Set a name (see [hostname, time zone and time sync](/guides/linux-hostname-time-settings)) and map it in `/etc/hosts`: ```text 127.0.0.1 localhost 203.0.113.10 pve1.example.com pve1 ``` **Verify:** `hostname --ip-address` prints `203.0.113.10` and no `127.x` address. ## Step 2: Add the Proxmox VE repository and key Work as root (`sudo -i`). Create `/etc/apt/sources.list.d/pve-install-repo.sources`: ```text Types: deb URIs: http://download.proxmox.com/debian/pve Suites: trixie Components: pve-no-subscription Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg ``` Download the repository key and compare its checksum with the one the Proxmox wiki lists: ```bash wget https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg -O /usr/share/keyrings/proxmox-archive-keyring.gpg sha256sum /usr/share/keyrings/proxmox-archive-keyring.gpg ``` The wiki gives `136673be77aba35dcce385b28737689ad64fd785a797e57897589aed08db6e45` as the SHA-256 value. Stop if yours differs. ## Step 3: Install the kernel, then Proxmox VE ```bash apt update && apt full-upgrade apt install proxmox-default-kernel systemctl reboot ``` After the reboot, install the Proxmox VE packages. When Postfix asks, choose **Local only** unless you know you need something else: ```bash apt install proxmox-ve postfix open-iscsi chrony ``` Remove the Debian kernel and `os-prober`, then update the boot menu: ```bash apt remove linux-image-amd64 'linux-image-6.12*' update-grub apt remove os-prober ``` **Verify:** `uname -r` shows a kernel with `pve` in its name after the next reboot, and `https://203.0.113.10:8006` shows the Proxmox VE sign-in page. Sign in as `root` with the **Linux PAM** realm. ## Step 4: Build a NAT bridge for the guests The Proxmox documentation's masquerading example keeps the public address on the network card and gives guests a private bridge. Proxmox VE manages the network in `/etc/network/interfaces`; make sure the file configures your public interface statically (copy the address and gateway from your service page), then add the bridge: ```text auto lo iface lo inet loopback auto eth0 iface eth0 inet static address 203.0.113.10/24 gateway 203.0.113.1 auto vmbr0 iface vmbr0 inet static address 10.10.10.1/24 bridge-ports none bridge-stp off bridge-fd 0 post-up echo 1 > /proc/sys/net/ipv4/ip_forward post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE ``` Use your own interface name instead of `eth0`. `ifreload` comes with `ifupdown2`, which a Debian-based installation may not have yet, and the rules need `iptables`. Install both, then apply the change from the console, so a mistake cannot lock you out: ```bash apt install ifupdown2 iptables ifreload -a ``` > **Warning** > > Do not add the public interface to a bridge (`bridge-ports eth0`) on a VDS. Guests would appear on the public network with their own MAC addresses, which data center networks commonly block. **Verify:** `ip -brief address` shows `vmbr0` with `10.10.10.1/24`, and SSH to the public address still works. ## Step 5: Create a guest and reach it 1. Upload an installation ISO under **local › ISO Images**, then **Create VM**. On the **Network** tab choose the bridge `vmbr0`. 2. Install the guest and give it a static address, for example `10.10.10.10/24` with the gateway `10.10.10.1` and public DNS servers. 3. To reach a guest service from outside, forward a port with a DNAT rule. Add it to the `vmbr0` stanza, so it is created with the bridge: ```text post-up iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2222 -j DNAT --to-destination 10.10.10.10:22 post-down iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 2222 -j DNAT --to-destination 10.10.10.10:22 ``` Run `ifreload -a` again; then `ssh -p 2222 user@203.0.113.10` reaches the guest. **Verify:** the guest can `ping 1.1.1.1`, and the forwarded port answers from your computer. ## Secure the host - Allow port `8006` and SSH only from your own addresses, with the Proxmox VE firewall (**Datacenter › Firewall**) or your server firewall. - Keep the host updated with `apt update && apt full-upgrade`. - Back up guests with the built-in **Backup** jobs to storage outside the server; see [backup strategy](/guides/backup-strategy-3-2-1). ## Troubleshooting **`hostname --ip-address` prints a 127.x address.** The `/etc/hosts` line from Step 1 is missing or wrong; Proxmox VE services will not start properly until it is fixed. **`error: bad shim signature` at boot.** Secure Boot rejects the Proxmox kernel. The wiki notes that installing on Debian is not supported with Secure Boot enabled. **Creating a VM fails with "KVM virtualisation configured, but not available".** The extensions are not visible; see [nested virtualization problems](/guides/nested-virtualization-problems). **The server lost its network after `ifreload -a`.** Fix `/etc/network/interfaces` from the console, comparing it with the address details on your service page. **Guests have no internet.** Check the guest's address and gateway, that `cat /proc/sys/net/ipv4/ip_forward` prints `1`, and that `iptables -t nat -L POSTROUTING -n` shows the MASQUERADE rule. ## Next steps - A lighter option without a web interface: [KVM virtual machines with libvirt](/guides/kvm-virtual-machines-libvirt). - Production hosts: [dedicated servers](/guides/dedicated-servers). ## Frequently asked questions ### Should I run Proxmox VE on a VDS or a dedicated server? On a VDS, Proxmox VE runs nested, which suits labs, training and testing. For production clusters, use dedicated servers, where the hypervisor runs directly on the hardware; Proxmox VE is one of the systems our dedicated servers offer in the order form. ### Why NAT instead of bridging the public network card? Bridging puts every guest on the public network with its own MAC address, which data center networks commonly block, and each guest would need its own public address. NAT shares the server's address and keeps the host's own connection unchanged. ### Do guests get addresses automatically? Not with the plain NAT bridge in this guide. Give each guest a static address in the 10.10.10.0/24 network with 10.10.10.1 as its gateway. ### Which port does the web interface use? 8006, over HTTPS: https://your-server-ip:8006. Sign in as root with the PAM realm on a fresh installation, and limit access to the port to your own addresses. --- Source: \ Updated: 2026-10-15