Proxmox networking tutorial a public IP for every virtual machine

Your addresses are in the Dedicated Server Setup email we sent the day your server was built, IPv4 first and then IPv6. You can also see them any time in your account: open the server and look at the panel called Access, Networking & rDNS.

On a Proxmox server, only the first address is set up on the host. The email tells you this under the list of addresses. We stop there on purpose: a host holding every address would answer for all of them, and your virtual machines would have nothing left to use. The rest are yours to give to virtual machines, or to the host if you want it to have more than one.

You need the same few values every time you place an address:

Netmask

/24Which is 255.255.255.0.

Gateway

.1The .1 of the range the address sits in, so 203.0.113.58 uses 203.0.113.1.

DNS on the host

209.244.0.3Your virtual machines can use any resolver you like.

IPv6

/64Gateway is the prefix followed by ::1. Step 06 has the details.

Most people should pick this one. Your virtual machine acts like its own computer on the same switch, talks to our routers directly, and the host needs no changes at all.

In Proxmox, add a network device to the virtual machine, choose vmbr0 as the bridge, and keep the MAC address Proxmox generates. Then set the address inside the virtual machine.

Debian or Ubuntu with ifupdown

/etc/network/interfaces

auto lo
iface lo inet loopback

auto ens18
iface ens18 inet static
    address 203.0.113.58/24
    gateway 203.0.113.1
    dns-nameservers 209.244.0.3 1.1.1.1

Ubuntu with netplan

/etc/netplan/01-netcfg.yaml

network:
  version: 2
  ethernets:
    ens18:
      addresses: [203.0.113.58/24]
      routes:
        - to: default
          via: 203.0.113.1
      nameservers:
        addresses: [209.244.0.3, 1.1.1.1]

Windows

Put the same address, netmask and gateway into the network adapter's IPv4 settings. The operating system makes no difference to us: your virtual machine is one more computer on the wire.

You do not need to tell us anything

There is no form to fill in for each new virtual machine, and you do not send us MAC addresses. Some hosts ask for both. We checked our side before saying so: the switch port your server uses has no limit on MAC addresses and port security is off. We also put a second address and MAC on one of our own servers and reached it from the internet.

A few rules keep it working:

• Give every virtual machine its own MAC address. If two share one, or one copies the host's, neither works properly.
• Use the gateway that matches the address's range, from step 01.
• Only use addresses that are on your account. This bridge connects to a network with other customers on it, and an address that is not yours takes their traffic away.
• Never run a DHCP server or send router advertisements on vmbr0, for the same reason. If you want automatic addressing, use the private bridge in step 05.

Many virtual machines only need to reach out, never be reached: build runners, workers, a database that should stay hidden. Give them private addresses on a second bridge, and the host translates their traffic to its own public IP. This uses none of your addresses, so you can run as many as the hardware allows.

Add a second bridge and leave vmbr0 as it is:

auto vmbr1
iface vmbr1 inet static
    address 10.10.10.1/24
    bridge-ports none
    bridge-stp off
    bridge-fd 0
    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE

Attach the virtual machines to vmbr1 and give each one an address in that range, with 10.10.10.1 as the gateway. The internet sees them as your server. Nothing can reach them from outside until you forward a port, which takes one more pair of lines on a port the host is not using:

post-up iptables -t nat -A PREROUTING -i eno1 -p tcp --dport 8443 -j DNAT --to 10.10.10.2:443
post-down iptables -t nat -D PREROUTING -i eno1 -p tcp --dport 8443 -j DNAT --to 10.10.10.2:443

Because vmbr1 has no physical port, a DHCP server on it is safe, and it is an easy way to address many machines.

You can set reverse DNS on any of your addresses yourself. Sign in, open the server, and go to Access, Networking & rDNS. Each address shows its current name with an Edit rDNS button beside it, and IPv6 addresses work the same way.

Enter a hostname: letters, numbers, hyphens and dots, at least two parts, each 1 to 63 characters long. The trailing dot is added for you. The change takes a few minutes.

If a virtual machine sends email, set reverse DNS on the address the mail leaves from. In the private setup that is the host's address. Add the matching forward record at your DNS provider too, because receiving mail servers check that both agree and reject mail when they do not.