Search Results

Assumptions This guide walks you through deploying a production-ready Proxmox VE 9.1 installation on a Hetzner dedicated root server running Debian 13 (Trixie). It covers everything from OS installation through post-install hardening and optimization — no clus...

Installing Proxmox VE

Overview This chapter installs Proxmox VE 9.1 on top of the Debian 13 system set up in the previous chapter. The installation is done by adding the Proxmox no-subscription repository and installing the packages directly — no ISO, no reinstall. By the end of th...

Configuring the Network Bridge

Diagram

Security Hardening

Overview This chapter locks down the two main attack surfaces on a public-facing Proxmox host: the SSH port and the Proxmox web interface on port 8006. UFW handles inbound traffic filtering, and fail2ban sits in front of both services to automatically ban IPs ...

Proxmox Helper Scripts

Overview The Proxmox VE Community Scripts project maintains a collection of open-source helper scripts for common Proxmox tasks. This chapter covers the four scripts relevant to a fresh node setup. All scripts are interactive — they use a terminal menu to walk...

Further Optimization

Overview This chapter applies a set of low-level host optimisations that improve performance, stability, and resource efficiency on a Proxmox node. All changes are persistent across reboots. A single reboot at the end is sufficient to activate everything. 1 —...

Public VM Connectivity on Hetzner via PfSense

How to provide public IP connectivity to Proxmox VMs using PfSense as a gateway on Hetzner dedicated servers. Covers three methods: single extra IP with MAC reservation (full guide including PfSense setup), extra subnet routed to the host, and Hetzner vSwitch ...

Overview — Choosing Your Method

Diagram

Method 1 — Single Extra IP with MAC Reservation

OverviewHetzner allows you to order a single additional IPv4 and bind it to a virtual MAC address. When a frame with that MAC arrives on the uplink, Hetzner routes the IP to it — regardless of which server or VM holds the NIC. You assign that MAC to the PfSens...

Method 2 — Extra Subnet Routed to Host

OverviewThis is the setup I run in my own lab — the one documented throughout this book with the example subnet. A /29 gives you 6 usable IPs which is enough for PfSense WAN, a jumpbox, and 3–4 service VMs without needing to subnet further. If you think you'll...

Method 3 — Hetzner vSwitch

OverviewBe honest with yourself before setting this up: if you're running one server, you don't need a vSwitch. I've seen people reach for it because it sounds more enterprise-grade, then spend an afternoon debugging VLAN tagging issues they wouldn't have had ...

Building a 3-Node Proxmox Cluster on Hetzner with vSwitch Networking

A complete guide to deploying a production-ready 3-node Proxmox VE cluster on Hetzner dedicated servers using two Hetzner vSwitches — one for private cluster heartbeat and VM traffic, one for public IP connectivity. Covers Hetzner Robot vSwitch provisioning, b...

Architecture & Prerequisites

Diagram

Hetzner Robot — vSwitch Setup

All Robot, No SSH Everything in this chapter happens in the Hetzner Robot web UI. You're not touching the servers yet — just provisioning the two vSwitches and wiring up the subnet. vSwitches themselves are free. The cost is the additional public subnet you'll...

Network Configuration on Each Node

Two Bridges, Three Nodes You're adding vmbr_priv and vmbr_pub to each node. The vmbr0 bridge from the first guide stays exactly as it is — these are additions. The config is identical across all three nodes except for the IP on the private bridge, which is uni...

Creating the Proxmox Cluster