Proxmox on a dedicated server
Proxmox turns one dedicated server into a dozen. The install is easy; the networking is where everybody loses an afternoon.
Why it fits bare metal well
KVM virtual machines and LXC containers under one interface, with snapshots, backups and live migration if you have more than one node. On a dedicated server you get the full hardware — the virtualisation extensions, the NVMe queues, the real network port — without a hypervisor already taking its share, which is the whole point of not doing this on a VPS.
Networking: use a routed block
This is where people get stuck. Our switches expect the MAC address they know about, so a bridge that puts guests directly on the public subnet with invented MAC addresses will not work — and would not be acceptable even if it did.
The right arrangement is a routed block: we route a subnet to your
server's main address, and you are free to do as you like inside it. In
/etc/network/interfaces:
auto vmbr0
iface vmbr0 inet static
address 198.51.100.1/29
bridge-ports none
bridge-stp off
bridge-fd 0
Guests take addresses from that block with the bridge as their gateway, and the host forwards:
net.ipv4.ip_forward=1 in /etc/sysctl.d/99-proxmox.conf
See additional addresses and routed subnets. Ask support for the block before you build the bridge, not after.
For IPv6 there is no reason to be frugal: give every guest its own address. See IPv6 on your server.
Storage
- ZFS
- Snapshots, checksums and compression, and Proxmox integrates with it directly. The usual choice. Give it memory — see ZFS on a dedicated server.
- LVM-thin
- Lighter, snapshots work, no checksums. Fine when memory is precious.
- A single ext4 directory
- Simplest, no snapshots. Acceptable for a lab, thin for production.
Mirror the disks. A single-disk hypervisor takes every guest with it when that disk fails; see RAID and disks.
Keep the interface private
The Proxmox web interface on port 8006 is a login page for your entire estate. Never leave it open to the internet. Either firewall it to your own addresses:
ufw allow from 203.0.113.0/24 to any port 8006 proto tcp
or reach it over WireGuard and allow nothing else. Enable two-factor authentication on the root account while you are there. The same reasoning as IPMI and the BMC applies: this is a layer below your guests, and everything inside them depends on it.
Back up the guests, and test it
vzdump with the built-in scheduler handles snapshots of running guests.
Send them off the machine — a Proxmox Backup Server on another box, or a
storage target elsewhere. A backup sitting on the same failing disk array has
protected nothing. Then do what testing a restore
says and actually restore one.
Two settings worth changing on day one
- Switch the repository to the no-subscription one if you do not hold a subscription, otherwise updates fail.
- Turn off the KSM memory sharing daemon if your guests belong to different customers; deduplicating memory across tenants is a side-channel you do not need.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base