How to install Proxmox VE 9 on a dedicated server (ISO or Debian 13)

Short answer: to install Proxmox VE, boot the official ISO on the server, or install Debian 13 first and add Proxmox’s repository: give the host a name that resolves to its public IP, install proxmox-default-kernel, reboot, then install proxmox-ve. The web interface answers on https://YOUR_IP:8006. Both routes expect hardware virtualisation, which in practice means bare metal.

This guide follows the Debian route, because it works on a rented server over SSH alone, and covers the parts the official page leaves to you: the network on a hosting provider’s switch, locking down port 8006, and moving VMs over from VMware. The steps are written from the Proxmox wiki and admin guide, read on 21 October 2026.

Proxmox needs bare metal, not a VPS

Proxmox VE is a type 1 hypervisor: it runs KVM virtual machines, and KVM needs the CPU’s virtualisation extensions (Intel VT-x or AMD-V) handed to it directly. Inside a VPS those extensions are only present if the provider passes them through as nested virtualisation, which adds overhead and which many providers do not offer. Containers (LXC) would still run, but a Proxmox host that cannot start VMs misses the point. The natural home is a dedicated server, whose product page says outright that you may install Proxmox or your own KVM stack on it.

lscpu | grep -E 'Virtualization|Hypervisor vendor'
ls -l /dev/kvm

On bare metal you want Virtualization: VT-x (or AMD-V) and no Hypervisor vendor line; that second line appears when you are inside a virtual machine yourself. If you are new to the platform, what is Proxmox VE explains VMs, containers and the subscription model first.

ISO or Debian: which route?

Whether a provider can boot your ISO is a feature of that provider, not of Proxmox, so ask before you plan on it. The Debian route needs nothing that a freshly installed server lacks. One trade-off: if the provider set Debian up on mdadm software RAID, the result works, but the Proxmox project does not support mdadm (it lacks the checksums ZFS has), so for a fully supported layout you need the ISO and ZFS.

Before you start

• A fresh Debian 13 (amd64) with a static IP and no desktop environment.
• A copy of the working network config: cp /etc/network/interfaces /root/interfaces.bak.
• A way back in if SSH drops. On a VMHeaven dedicated server that is the serial console in the panel; open it once and check that it shows a login prompt before you touch the network.
• A root password. The web interface logs in through PAM with the Linux root account, so a server set up with SSH keys only needs passwd first.

Install Proxmox VE 9 on Debian 13

1. 1Hostname and /etc/hosts

   The hostname must resolve to the server’s real IP. Debian’s installer often maps it to 127.0.1.1, and the Proxmox wiki recommends taking it off that line to avoid ambiguity. Map it to the public address instead:

   127.0.0.1       localhost
   203.0.113.10    pve1.example.com pve1

   hostnamectl set-hostname pve1
   hostname --ip-address        # must show 203.0.113.10, not only 127.0.1.1

   Changing the hostname and the hosts file explain both files.

2. 2Add the Proxmox repository and its key

   Types: deb
   URIs: http://download.proxmox.com/debian/pve
   Suites: trixie
   Components: pve-no-subscription
   Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

   wget https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg \
     -O /usr/share/keyrings/proxmox-archive-keyring.gpg
   sha256sum /usr/share/keyrings/proxmox-archive-keyring.gpg

   Compare the hash with the one on the Proxmox wiki page “Install Proxmox VE on Debian 13 Trixie”. On 21 October 2026 it read:

   136673be77aba35dcce385b28737689ad64fd785a797e57897589aed08db6e45  /usr/share/keyrings/proxmox-archive-keyring.gpg

3. 3Update and install the Proxmox kernel

   apt update && apt full-upgrade
   apt install proxmox-default-kernel
   systemctl reboot

   After the reboot, uname -r should end in -pve.

4. 4Install the Proxmox VE packages

   apt install proxmox-ve postfix open-iscsi chrony

   Postfix asks how to deliver mail. Without a mail server of your own, choose “Local only” and keep the suggested system name, as the Proxmox page advises.

5. 5Remove the Debian kernel and os-prober

   apt remove linux-image-amd64 'linux-image-6.12*'
   update-grub
   apt remove os-prober

   os-prober goes because it scans every partition for other operating systems to add to the boot menu, and on a hypervisor that includes the disks of your VMs.

6. 6Log in to the web interface

   Open https://203.0.113.10:8006, accept the self-signed certificate, and log in as root with the realm “Linux PAM standard authentication”. A “No valid subscription” notice at login is expected without a paid subscription.

Enterprise or no-subscription repository

Installing proxmox-ve also sets up the enterprise repository, which only answers with a subscription key; without one, apt update reports a 401 error for it. If you do not buy a subscription, open Node, Updates, Repositories in the web interface, disable the enterprise entries (Proxmox VE and, if present, Ceph) and keep pve-no-subscription. With a subscription it is the other way round: upload the key and remove the no-subscription file. Always update a Proxmox host with apt full-upgrade, never plain apt upgrade, which can hold back packages a Proxmox update needs.

Networking: vmbr0, routed or NAT

Proxmox connects VMs through Linux bridges. The default design, and the one the ISO sets up, puts the physical NIC into a bridge called vmbr0 and moves the host IP onto it:

auto lo
iface lo inet loopback

iface eno1 inet manual

auto vmbr0
iface vmbr0 inet static
        address 203.0.113.10/24
        gateway 203.0.113.1
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0

In a bridged setup each VM appears on the physical network with its own MAC address. That is exactly what many data-centre switches refuse: the Proxmox docs note that most hosting providers disable networking when they see several MAC addresses on one port. Which model works depends on your provider:

• Bridged, if the provider gives your additional IPs their own (virtual) MAC addresses to set on the VMs.
• Routed, if additional IPs are routed to your main IP: the host forwards packets to the VMs, the bridge has bridge-ports none, and only the server’s own MAC ever reaches the switch.
• NAT, if you have one public IP: VMs sit on a private bridge and reach the internet through the host, with port forwards for anything they serve.

NAT is the safe first step because it leaves the main interface alone. Add a second bridge with private addresses (here vmbr0 carries the public IP; use the NIC name instead if you did not bridge it):

auto vmbr1
iface vmbr1 inet static
        address 10.10.10.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE

Before you change the interface that carries SSH, ask your provider which model they support and how extra IPs are delivered, and give yourself an automatic way back. Schedule a rollback, apply the change, and cancel the rollback only once you can still log in:

systemd-run --on-active=10min --unit=net-rollback \
  /bin/sh -c 'cp /root/interfaces.bak /etc/network/interfaces && ifreload -a'
ifreload -a                         # apply the new config
# still connected? cancel the rollback:
systemctl stop net-rollback.timer

Changes made in the web interface are staged in /etc/network/interfaces.new and applied with the “Apply Configuration” button, which runs the same ifreload.

Secure the web interface

Port 8006 is a root login page on the public internet the moment the install finishes. Narrow it down before you create the first VM:

• Limit who can reach it. Either allow only your own address in /etc/default/pveproxy (ALLOW_FROM, DENY_FROM="all", POLICY="allow", then systemctl restart pveproxy.service spiceproxy.service), or keep 8006 closed and use an SSH tunnel: ssh -L 8006:localhost:8006 root@203.0.113.10, then https://localhost:8006. A WireGuard VPN does the same for a team.
• Turn on two-factor authentication under Datacenter, Permissions, Two Factor: TOTP apps, WebAuthn security keys and recovery keys are supported.
• Use the Proxmox firewall carefully. Once enabled at Datacenter level, it drops everything except management traffic (8006, SSH, consoles) from hosts in the management IP set, which by default covers the local cluster network. Add your own address to that set first, or you lock yourself out.
• Work as a named user, not root: create one in the Proxmox VE realm with the Administrator role, keep root for emergencies, and harden SSH as on any server (securing SSH access).

Migrate VMware VMs to Proxmox

Since Proxmox VE 8.2 (April 2024) an import wizard pulls VMs straight from an ESXi host or vCenter. The Proxmox wiki says it was tested with ESXi 6.5 up to 8.0. The steps:

1. 1Prepare the source VM

   Note its network and disk settings. On Windows guests, uninstall VMware Tools while the VM still runs on VMware, and have the VirtIO driver ISO ready.

2. 2Add the ESXi host as storage

   Datacenter, Storage, Add, ESXi: enter the host or vCenter address and an admin account. For a self-signed certificate, add its CA or tick Skip Certificate Verification.

3. 3Shut the VM down and import it

   Select the new storage, pick the VM and click Import. Choose the target storage, the bridge and the disk controller. Power the source VM off first for a consistent copy.

4. 4Boot and fix drivers

   Windows boots most reliably on SATA first; install the VirtIO drivers, then switch the disk to VirtIO SCSI for performance. Check that the network card got the right address.

The wiki lists the limits: disks on vSAN do not work, encrypted disks cannot be imported, VMs with snapshots import much more slowly, and going through vCenter instead of the ESXi host itself is dramatically slower. A “live import” option starts the VM while the data still copies, but if the import fails, everything written since it started is lost. For exported files there are command-line tools:

pvesm status                                           # list storage IDs
qm importovf 120 /mnt/export/web01.ovf local           # whole VM from an OVF export
qm disk import 120 /mnt/export/web01-disk1.vmdk local  # one disk into existing VM 120

After the Debian route the only storage is local, a directory under /var/lib/vz; the ISO install also creates local-lvm or local-zfs. Use whatever ID pvesm status lists.

Do not expose the ESXi API to the internet for the transfer; connect the two sites over a VPN instead. Hyper-V vs VMware explains the other platforms you may be moving away from.

Common problems

Frequently asked