Install Proxmox VE 9 on one server: a first-week setup

Proxmox VE is a free virtualisation platform built on Debian. It runs full VMs (KVM) and lightweight Linux containers (LXC), and you manage both from one web interface. This guide takes one server from a blank disk to a working host, with updates, networking, storage, two-factor login and a firewall, plus one container and one VM.

author
Zahara Schaefer
published
updated
read
7 min
tested
Proxmox VE 9.x on Debian 13 trixie (repository and command syntax from the official docs; UI labels may differ slightly between point releases)
outline {
  1. What you need
  2. 1. Install from the ISO
  3. 2. Switch to the no-subscription repository
  4. 3. Check the network bridge, and make it VLAN-aware
  5. 4. Set up storage
  6. 5. Lock down access
  7. 6. Turn on the firewall, without locking yourself out
  8. 7. Create your first container
  9. 8. Create your first VM
  10. Troubleshooting
  11. References

If you already run several hosts, or you want clustering and high availability, read Running Proxmox in production after this one.

What you need

  • A 64-bit server with CPU virtualisation (Intel VT-x or AMD-V) turned on in the firmware.
  • Enough RAM for the host plus your guests. The system requirements list the minimums.
  • One disk for the system. Two matching disks if you want a ZFS mirror.
  • A USB stick of 2 GB or more, and a wired network connection with a static IP address you've reserved.
  • The Proxmox VE 9 ISO from the Proxmox downloads page.

Install from the ISO

Write the ISO to the USB stick. On Linux:

bash
lsblk                                   # find the USB device, for example /dev/sdX
sudo dd if=proxmox-ve_9.*.iso of=/dev/sdX bs=1M conv=fsync status=progress

dd overwrites whatever device you give it, so check the device name twice. On Windows or macOS, use Etcher or Rufus in DD mode.

Boot from the stick and choose Install Proxmox VE (Graphical). The installer asks for:

  • Target disk and file system. Use ext4 or xfs on LVM for a single disk. With two disks, choose ZFS (RAID1), which gives you mirroring, snapshots and checksums.
  • Country, time zone and keyboard.
  • Root password and email. The email address gets system notifications.
  • Management network. The interface, hostname (a full name such as pve1.example.lan), IP address in CIDR form, gateway and DNS server.

When it finishes, remove the stick and reboot.

Check it worked: the console shows https://<your-ip>:8006/, and that page loads in a browser. Log in as root with the Linux PAM realm. The certificate warning is expected, because the host uses a self-signed certificate.

Switch to the no-subscription repository

A fresh install points at the enterprise repository, which needs a paid subscription. Without one, apt update fails with a 401 error. Proxmox VE 9 uses the deb822 .sources format for repositories.

Disable the enterprise repository by adding Enabled: no to its file:

bash
echo 'Enabled: no' >> /etc/apt/sources.list.d/pve-enterprise.sources

Add the no-subscription repository:

bash
cat > /etc/apt/sources.list.d/proxmox.sources <<'SRC'
Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
SRC

If you don't plan to use Ceph, disable its enterprise repository the same way (/etc/apt/sources.list.d/ceph.sources). You can also do all of this in the web UI under your node > Updates > Repositories.

Then update:

bash
apt update && apt full-upgrade

Use full-upgrade (or dist-upgrade), never plain apt upgrade, on Proxmox VE. Plain upgrade can leave packages half updated.

Check it worked: apt update finishes without a 401 error, and pveversion prints a 9.x version.

Check the network bridge, and make it VLAN-aware

The installer creates a Linux bridge called vmbr0 with your management IP on it. Guests attach to this bridge. Look at /etc/network/interfaces:

text
auto lo
iface lo inet loopback

iface eno1 inet manual

auto vmbr0
iface vmbr0 inet static
        address 192.0.2.10/24
        gateway 192.0.2.1
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 2-4094

The two VLAN lines aren't there by default. Add them if your switch port carries tagged VLANs. Then, in each guest's network settings, set the VLAN Tag to put it on a VLAN. In the web UI, this is node > System > Network > vmbr0 > VLAN aware. Click Apply Configuration afterwards. Proxmox VE uses ifupdown2, so changes apply without a reboot.

Do network changes from the physical console or IPMI if you can. A typo here cuts you off from the web UI.

Check it worked: ip -br addr show vmbr0 shows your address, and you can still reach port 8006.

Set up storage

A default install creates:

  • local, a directory for ISOs, container templates and backups;
  • local-lvm (an LVM thin pool) or local-zfs, for guest disks.

Run pvesm status to see them.

To add a second disk as a ZFS pool for guests, do it in the UI under node > Disks > ZFS > Create: ZFS, or from the shell:

bash
lsblk -o NAME,SIZE,MODEL,SERIAL            # identify the disk
zpool create -o ashift=12 tank /dev/disk/by-id/<disk-id>
pvesm add zfspool tank --pool tank --content images,rootdir

Use the /dev/disk/by-id/ path, not /dev/sdb. Device letters can change between boots.

Don't keep your only backups on the same machine. See the Proxmox backup checklist for that.

Check it worked: pvesm status lists the new storage as active.

Lock down access

Create a named admin account, so you aren't sharing root:

bash
pveum user add zahara@pve --comment "Admin"
pveum passwd zahara@pve
pveum acl modify / --users zahara@pve --roles Administrator

Then turn on two-factor login. Log in as the new user, open user menu (top right) > TFA, and add a TOTP entry with your authenticator app. Save the recovery keys it offers somewhere offline. Do the same for root@pam.

Check it worked: log out, log back in as zahara@pve (realm Proxmox VE authentication server), and you're asked for a code.

Turn on the firewall, without locking yourself out

The Proxmox VE firewall works at three levels: datacenter, node and guest. It's off at the datacenter level by default.

Before you turn it on, add rules that let you in. Under Datacenter > Firewall > Add, create inbound ACCEPT rules from your admin network for TCP 8006 (web UI) and TCP 22 (SSH). Or write them to /etc/pve/firewall/cluster.fw:

ini
[OPTIONS]
enable: 1

[RULES]
IN ACCEPT -source 192.0.2.0/24 -p tcp -dport 8006 -log nolog
IN ACCEPT -source 192.0.2.0/24 -p tcp -dport 22 -log nolog
IN ACCEPT -p icmp -log nolog

Proxmox VE adds a management IP set and rules that keep the web UI reachable from the local network, but check the generated ruleset rather than relying on it. There's also an nftables-based firewall (proxmox-firewall), but the docs still mark it as a technology preview that isn't suited for production. Stay on the default for now.

Check it worked: pve-firewall status reports enabled/running, and you can still load the web UI from your admin network.

Create your first container

Download a template and create an unprivileged container:

bash
pveam update
pveam available --section system | grep debian
pveam download local debian-13-standard_<version>_amd64.tar.zst

pct create 200 local:vztmpl/debian-13-standard_<version>_amd64.tar.zst \
  --hostname web01 --memory 1024 --cores 1 \
  --rootfs local-lvm:8 \
  --net0 name=eth0,bridge=vmbr0,ip=dhcp \
  --unprivileged 1 --features nesting=1 \
  --password
pct start 200

Replace <version> with the version shown by pveam available. --password with no value prompts for the root password. nesting=1 is needed by recent systemd inside containers.

Check it worked: pct exec 200 -- ip -br addr shows an address, and pct enter 200 gives you a shell.

Create your first VM

Upload an installer ISO to local (local > ISO Images > Upload, or Download from URL), then:

bash
qm create 100 --name app01 --memory 4096 --cores 2 --cpu host \
  --net0 virtio,bridge=vmbr0 \
  --scsihw virtio-scsi-single --scsi0 local-lvm:32,iothread=1,discard=on \
  --ide2 local:iso/debian-13-netinst.iso,media=cdrom \
  --boot 'order=scsi0;ide2' --ostype l26 --agent enabled=1
qm start 100

Open the console from the web UI and install the OS. Afterwards, install the guest agent inside the VM so Proxmox VE can see its IP and freeze file systems during backups:

bash
apt install qemu-guest-agent
systemctl enable --now qemu-guest-agent

--cpu host gives the best performance. If you later build a cluster with mixed CPUs, switch to a generic model such as x86-64-v2-AES so live migration works.

Check it worked: the VM's Summary page shows its IP addresses, which come from the guest agent.

Troubleshooting

SymptomCauseFix
401 Unauthorized on apt updateEnterprise repository still enabledStep 2. Check every file in /etc/apt/sources.list.d/.
"No valid subscription" popup at loginExpected without a subscriptionHarmless. Buying a subscription removes it and gives you the enterprise repository.
VM won't start: KVM virtualisation configured, but not availableVT-x or AMD-V disabledTurn it on in the firmware.
Container has no networkWrong bridge, or VLAN tag on a bridge that isn't VLAN-awareCheck --net0 and step 3.
Lost the web UI after a network changeTypo in /etc/network/interfacesFix it from the console, then run ifreload -a.

References