Installing Proxmox VE

Overview

This chapter installs Proxmox VE 9.1 on top of the Debian 13 system set up in the previous chapter. The installation is done by adding the Proxmox no-subscription repository and installing the packages directly — no ISO, no reinstall. By the end of this chapter Proxmox VE will be installed, the NIC offload settings will be hardened, and the server will be ready to reboot into the Proxmox web interface.

Step 1 — Configure Hostname and /etc/hosts

This step catches people off guard more than it should. The 127.0.1.1 entry Debian writes during install looks harmless but Proxmox's cluster stack uses the hostname resolution to determine which IP to bind to. Get it wrong and everything appears to work — until you try to add a second node and get confusing quorum failures that don't obviously trace back to /etc/hosts.

Proxmox requires the server hostname to be a fully-qualified domain name (FQDN) that resolves to the server’s real public IP address — not to 127.0.0.1 or 127.0.1.1. Debian sometimes writes a 127.0.1.1 entry for the hostname during install; that must be removed.

Replace pve.yourdomain.com with your actual FQDN and YOUR_SERVER_IP with the server’s public IP.

hostnamectl set-hostname pve.yourdomain.com

Open /etc/hosts and ensure it looks like this, removing any 127.0.1.1 line that references the hostname:

127.0.0.1       localhost
YOUR_SERVER_IP  pve.yourdomain.com pve

Verify the result:

hostname --fqdn

The output must return the full FQDN. If it returns only the short name, the /etc/hosts entry is incorrect.

Step 2 — Add the Proxmox No-Subscription Repository

The no-subscription repository provides the same packages as the enterprise repository without requiring a paid licence. It receives updates slightly later but is fully functional for production use.

echo "deb [arch=amd64] http://download.proxmox.com/debian/pve trixie pve-no-subscription"     > /etc/apt/sources.list.d/pve-no-subscription.list

If the Proxmox enterprise repository file exists, remove it to avoid authentication errors during updates:

rm -f /etc/apt/sources.list.d/pve-enterprise.list

Step 3 — Import the Proxmox GPG Key

The GPG key allows apt to verify that packages from the Proxmox repository are authentic and have not been tampered with.

curl -fsSL https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg     -o /etc/apt/trusted.gpg.d/proxmox-release-trixie.gpg

Step 4 — Update and Full-Upgrade

Refresh the package lists to include the new Proxmox repository, then upgrade any existing packages before installing Proxmox. Running a full-upgrade first avoids dependency conflicts during the Proxmox install.

apt-get update
apt-get full-upgrade -y

Step 5 — Install Proxmox VE

When prompted by the Postfix installer, select Local only and use the server FQDN as the mail name. Postfix is a dependency of Proxmox VE for local notification delivery.

apt-get install -y proxmox-ve postfix open-iscsi chrony

Package	Purpose
`proxmox-ve`	The Proxmox VE meta-package — pulls in the kernel, web UI, storage stack, and virtualisation tools
`postfix`	Local mail delivery for system notifications and alerts
`open-iscsi`	iSCSI initiator, required by the Proxmox storage subsystem
`chrony`	NTP time synchronisation — accurate time is critical for cluster state and VM clocks

Step 6 — Remove os-prober

os-prober scans all disks for other operating systems during GRUB updates. On a Proxmox host this can cause GRUB to incorrectly detect VM disk images as bootable systems and add them to the boot menu.

apt-get remove -y os-prober

Step 7 — Disable NIC Offload Features

The NIC offload section below is the step most guides skip, and it's the one that will cost you the most time if you miss it. The symptoms — random packet drops, SSH sessions that hang under load, TCP connections that stall and recover — look exactly like a hardware or cable problem. I spent several hours on this the first time before finding the root cause. Just do it.

This step is critical and must not be skipped. Incorrect NIC offload settings on a Proxmox host cause network instability, dropped packets, and silent checksum errors for traffic passing through the virtual bridge. Symptoms are intermittent and difficult to diagnose after the fact. Apply the correct flags for your NIC before rebooting into Proxmox.

Identify Your NIC and Driver

Find the name of the interface used for outbound traffic:

ip route get 1.1.1.1

Look for the dev field in the output (e.g. eth0, eno1, enp3s0). Then get the driver for that interface:

ethtool -i INTERFACE_NAME

Look for the driver: line. Cross-reference it with the table below to determine which flags to disable.

To review all current offload settings before and after applying changes:

ethtool -k INTERFACE_NAME

Offload Flags by Manufacturer

Manufacturer	Common Drivers	Flags to Disable	Reason
Intel	igb, i40e, ixgbe, e1000e	tso gso gro	Segmentation offload causes corruption on bridged traffic at high throughput
Mellanox	mlx4, mlx5	tso gso gro tx rx	Hardware checksum offload interacts badly with the Linux bridge in some firmware versions
Realtek	r8169, r8168, r8125	tso gso gro tx rx	Realtek’s TX checksum offload implementation is unreliable in Linux and can cause silent data corruption

Apply the Settings

Replace INTERFACE_NAME with your interface and use the flags from the table above. Example for an Intel NIC:

ethtool -K INTERFACE_NAME tso off gso off gro off

Example for Mellanox or Realtek:

ethtool -K INTERFACE_NAME tso off gso off gro off tx off rx off

Persist Across Reboots

The ethtool command applies settings only until the next reboot. Choose one of the two methods below to make them permanent.

Method 1 — systemd service (recommended)

Create /etc/systemd/system/nic-offload.service:

[Unit]
Description=Disable NIC offload features for Proxmox VE
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ethtool -K INTERFACE_NAME tso off gso off gro off
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Adjust the ExecStart line to match your interface and flag set, then enable the service:

systemctl daemon-reload
systemctl enable nic-offload.service

The service runs once at boot after the network target is reached, before Proxmox brings up the bridge. This method is recommended because it is independent of the network configuration file and survives interface renames.

Method 2 — post-up in /etc/network/interfaces

Add a post-up line under the physical interface block in /etc/network/interfaces. This is configured in the next chapter alongside the bridge. Example:

iface eno1 inet manual
    post-up ethtool -K eno1 tso off gso off gro off

This ties the offload settings to the interface coming up, but depends on the interfaces file being configured correctly. Use the systemd method if you are unsure.

Step 8 — Reboot into Proxmox VE

Reboot the server to load the Proxmox kernel and start all Proxmox services:

reboot

Once back online, the Proxmox web interface is accessible at:

https://YOUR_SERVER_IP:8006

Log in with root and the server’s root password. You will see a subscription notice on the dashboard — this is addressed in the Proxmox Helper Scripts chapter.

Automating with the Script

If you're setting this up for the first time, I'd suggest running the steps manually at least once before reaching for the script. You'll understand what each part does and you'll be in a much better position to debug if something goes sideways on a future rebuild.

All steps in this chapter are automated by the ProxMox-VE-Debian-13.sh script, attached to this page.

The script detects the NIC driver automatically, applies the correct offload flags for the detected manufacturer, and creates the systemd persistence service — no manual input required beyond the FQDN.

On the freshly installed Debian 13 system, download and run it:

curl -fsSL https://docs.devopsawi.com/attachments/1     -o ProxMox-VE-Debian-13.sh
chmod +x ProxMox-VE-Debian-13.sh
./ProxMox-VE-Debian-13.sh pve.yourdomain.com

The FQDN can be passed as the first argument or entered interactively when prompted. The script outputs each step as it runs, clearly highlights the NIC detection result, and confirms when setup is complete. Reboot manually after the script finishes.