When your server was handed over, one IPv4 address was set up on it and the rest were left alone. That is deliberate, and this page is how you finish the job. There are three ways to do it and none of them takes long: put the machine straight onto the network with its own address, send its traffic through the host, or hide a whole set of machines behind the address you already have. We tested all three on our own network before writing this.
Read the first two. After that, steps three, four and five are alternatives — pick the one that matches what you are building.
Look for the email titled Dedicated Server Setup, sent the day the machine was built. It lists everything allocated to the server: the IPv4 addresses first, then any IPv6. The same list lives in your account, on the server's page, in the panel headed Access, Networking & rDNS.
On a Proxmox server that email adds a line under the list, telling you that the host has been given the first address only and that the remaining ones are yours to hand out — to virtual machines, or to the host as well if you want it holding more than one. We set up a single address so the machine comes up reachable, then stop. Configure them all on the host and it answers for all of them, leaving your virtual machines nothing to claim.
Two numbers matter every time you type an address. The netmask is /24, which is 255.255.255.0. The gateway is that address's own range, ending in .1 — so an address in 203.0.113.0/24 uses 203.0.113.1. Addresses issued together sit next to each other and share one gateway. Addresses added to a server months later can come from a different range of ours, and then they use their own .1 instead. Getting this wrong is the single most common reason a new virtual machine cannot reach anything, and it costs people an afternoon.
For DNS we set up 209.244.0.3 on the host. Point your virtual machines wherever you like.
Log in over SSH as root and have a look:
ip -br addr cat /etc/network/interfaces
On a machine we have just built, that file reads roughly like this, with your interface name and your own first address instead of the ones shown:
auto lo
iface lo inet loopback
iface eno1 inet manual
auto vmbr0
iface vmbr0 inet static
address 203.0.113.10/24
gateway 203.0.113.1
bridge-ports eno1
bridge-stp off
bridge-fd 0
The useful thing to notice is that vmbr0 is already a bridge, and the network card is already plugged into it. Nothing else is needed for step three, which is why step three asks you to change nothing here.
Proxmox VE 9 sits on Debian 13 and uses ifupdown2, so network changes take effect without restarting the machine. Save the file and run:
ifreload -a
Editing through the Proxmox web interface instead writes your changes to /etc/network/interfaces.new and holds them until you press Apply Configuration. Whichever you use, open the console from your account first. One typo in this file and the machine drops off the network; the console goes in another way and will still work.
Start here. Your virtual machine behaves like a separate computer plugged into the same switch, it talks to our routers itself, and the host needs no changes whatsoever.
In Proxmox, add a network device to the machine, set the bridge to vmbr0, and leave the MAC address Proxmox filled in. Then set the address inside the machine. Debian or Ubuntu with the classic setup:
auto lo
iface lo inet loopback
auto ens18
iface ens18 inet static
address 203.0.113.58/24
gateway 203.0.113.1
dns-nameservers 209.244.0.3 1.1.1.1
Ubuntu with netplan, in /etc/netplan/01-netcfg.yaml:
network:
version: 2
ethernets:
ens18:
addresses: [203.0.113.58/24]
routes:
- to: default
via: 203.0.113.1
nameservers:
addresses: [209.244.0.3, 1.1.1.1]
On Windows, the same three values go into the adapter's IPv4 settings. It genuinely does not matter what the machine runs; to us it is one more computer on the wire.
There is nothing to tell us first. You do not have to send us the MAC address of every virtual machine, and we do not cap how many your port may use. A number of hosting companies do, and their instructions have you filling in a form for each new machine. We checked rather than assuming: the port your server sits on has no MAC limit set and port security is switched off, and before publishing this we put a second address and MAC on a staff machine's own port and reached it from the public internet.
Three things worth getting right:
• Every machine needs its own MAC address. Two machines sharing one, or copying the host's, and neither works properly.
• Use the gateway belonging to that address's range, from step one.
• Only use addresses that are on your account. This bridge faces a real network with other people's machines on it. An address that is not yours takes their traffic with it.
Same reason: nothing that hands out addresses belongs on vmbr0. No DHCP server, no router advertisements. If you want to hand addresses to your own machines automatically, use step five, where the bridge has no way out and cannot reach anybody else.
Choose this when you want the host to see every packet, so its firewall can act on it, or when you would rather your machines never appeared on the shared network at all. They still get real public addresses from your account; only the path changes.
The public address comes off the bridge and goes onto the network card, the host is told to forward, and it answers on behalf of the machines behind it. On the host:
auto lo
iface lo inet loopback
auto eno1
iface eno1 inet static
address 203.0.113.10/24
gateway 203.0.113.1
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up echo 1 > /proc/sys/net/ipv4/conf/eno1/proxy_arp
auto vmbr0
iface vmbr0 inet manual
bridge-ports none
bridge-stp off
bridge-fd 0
up ip route add 203.0.113.58/32 dev vmbr0
down ip route del 203.0.113.58/32 dev vmbr0
One up and down line for each address you route this way. Inside the machine the address is a /32, and the host has to be reached by an explicit route before the default one:
auto lo
iface lo inet loopback
auto ens18
iface ens18 inet static
address 203.0.113.58/32
post-up ip route add 203.0.113.10 dev ens18
post-up ip route add default via 203.0.113.10
dns-nameservers 209.244.0.3 1.1.1.1
Do not drop the proxy_arp line. Our routers ask the network who holds each address, and that line is what makes the host answer for the machines behind it. Leave it out and they are simply invisible. The two post-up echo lines are Proxmox's own way of writing it. To set them permanently instead, drop a file into /etc/sysctl.d/ containing:
net.ipv4.ip_forward=1 net.ipv4.conf.eno1.proxy_arp=1
What you are buying with the extra work is a host that can filter and log every packet. If you do not need that, step three is less to go wrong.
Plenty of machines only ever start conversations: build runners, queue workers, a database nothing outside should touch. Give those a private address on a bridge with no way out of its own, and let the host translate their traffic onto its address on the way past. It uses none of your allocation, so you can run as many as the hardware will carry.
Add a second bridge, leaving vmbr0 exactly as it is:
auto vmbr1
iface vmbr1 inet static
address 10.10.10.1/24
bridge-ports none
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
Put the machines on vmbr1, give each one an address in that range with 10.10.10.1 as its gateway, and they are away. To the rest of the internet they look like your server. Nothing reaches them from outside unless you ask for it, and asking is one more rule beside the first, on a port the host is not already using:
post-up iptables -t nat -A PREROUTING -i eno1 -p tcp --dport 8443 -j DNAT --to 10.10.10.2:443 post-down iptables -t nat -D PREROUTING -i eno1 -p tcp --dport 8443 -j DNAT --to 10.10.10.2:443
This bridge has no physical port, so a DHCP server on it is safe and is a tidy way to address the machines behind it.
What you have is a handful of separate IPv6 addresses, not a block to divide up. They are at the bottom of the same setup email, and they are placed one at a time exactly like IPv4 ones: one on the host if you want the host reachable over IPv6, the others on whichever machines need them. The installer configures none of them, so all of this is yours to add.
Write each one with a /64 on the end, and the gateway is the prefix with ::1 after it — an address inside 2001:db8:1234::/64 uses 2001:db8:1234::1. On the host, alongside the bridge that is already there:
iface vmbr0 inet6 static
address 2001:db8:1234::2/64
gateway 2001:db8:1234::1
And in a machine on the bridge:
iface ens18 inet6 static
address 2001:db8:1234::5/64
gateway 2001:db8:1234::1
Then ifreload -a, as before. Because these are individual addresses rather than a block of your own, do not advertise routes or hand out addresses you were not given. Short of what you need? Ask us.
You set reverse DNS yourself, on any address, without asking anybody. Sign in, open the server, and find the panel headed Access, Networking & rDNS. Every address is listed with whatever name it currently answers to and an Edit rDNS button beside it. IPv6 addresses work the same way.
The box wants a hostname: letters, numbers, hyphens and dots, each part between 1 and 63 characters, at least two parts, and the trailing dot is added for you. Give it a few minutes to take effect.
If the machine sends email, the address to name is the one the mail actually leaves from — with step five that is the host's address, not the machine's — and you will also want the matching forward record at your DNS provider. Mail servers on the other end check that the two agree, and refuse mail when they do not.
What people ask us after following this page.