Proxmox VE 8.x: From Bare Metal to Production-Ready Hypervisor

Official Site: proxmox.com | Documentation: pve.proxmox.com/pve-docs | Download ISO: proxmox.com/en/downloads | GitHub: github.com/proxmoxve

If you are running a homelab or a small production setup, Proxmox VE is probably the best hypervisor you can pick. It is open-source, based on Debian, and gives you both KVM virtual machines and LXC containers in one management interface. No separate vCenter license, no VMware tax, no closed-source drama.

I have been running Proxmox for a while across a couple of hosts, and it just works. The web UI on port 8006 handles almost everything — creating VMs, managing storage, setting up networking, taking backups, even clustering multiple nodes. This guide walks through the full setup from bare metal to a production-ready configuration.

Prerequisites

Before we start, here is what you need:

• A dedicated server or PC with a 64-bit CPU (Intel VT-x or AMD-V)
• At least 4 GB RAM (8 GB+ recommended for any real workload)
• One or more SSDs for the OS and VM storage
• A USB stick (4 GB+) to write the installer
• Network cable connected — Proxmox needs a static IP during install

If you are installing on a remote server with IPMI/iDRAC, you can mount the ISO virtually instead of using a USB stick.

Step 1: Download the ISO and Create a Bootable USB

Head over to the Proxmox downloads page and grab the latest ISO. As of mid-2026, Proxmox VE 9.2 is the current stable release (based on Debian 13 Trixie), but the steps here apply to version 8.x and above.

Write the ISO to a USB stick. On Linux, dd works fine:

# Download the ISO
wget https://enterprise.proxmox.com/iso/proxmox-ve_8.4-1.iso

# Write to USB (replace /dev/sdX with your USB device)
sudo dd if=proxmox-ve_8.4-1.iso of=/dev/sdX bs=1M status=progress
sync

On Windows, use Rufus or balenaEtcher. Make sure you select “DD Image” mode in Rufus, not ISO mode.

Alternatively, if your server has IPMI with virtual media support, mount the ISO directly without touching a USB stick.

Step 2: Bare Metal Installation

Boot from the USB stick. The Proxmox installer uses a simple ncurses-based interface. Here is the flow:

1. EULA — Accept the license agreement.
2. Target Disk — Pick the disk where Proxmox will be installed. The entire disk will be wiped.
3. Filesystem — Choose between ext4 (simple, good for single disk) or ZFS (recommended for multiple disks, offers checksums, snapshots, compression).
4. Country / Timezone — Set your location so the clock is correct.
5. Password & Email — Root password and a valid email for system notifications.
6. Network — Static IP configuration: IP address, netmask, gateway, DNS. This is critical — Proxmox needs a fixed IP for the web UI and cluster communication.

The install takes about 5 minutes. Once done, reboot and remove the USB stick.

Step 3: First Login and System Update

After reboot, you will see the Proxmox console showing the management IP. Open a browser and go to:

https://YOUR_SERVER_IP:8006

Login with root and the password you set during installation. You will see a certificate warning because Proxmox uses a self-signed cert — that is normal, just accept it.

First thing — update the system and configure repositories:

# Log in via SSH or the console shell
ssh root@YOUR_SERVER_IP

# Remove the enterprise repo (needs subscription)
rm /etc/apt/sources.list.d/pve-enterprise.list

# Add the no-subscription repo
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" \
  > /etc/apt/sources.list.d/pve-no-subscription.list

# Update everything
apt update && apt dist-upgrade -y

# Reboot if kernel was updated
reboot

Step 4: Storage Configuration with ZFS

If you picked ZFS during installation, Proxmox creates a pool called rpool with a rpool/data dataset for VM images. For production, I recommend separating your VM storage from the OS.

Here is how to add a dedicated ZFS pool with two mirrored SSDs:

# Create a ZFS mirror pool for VM storage
zpool create -o ashift=12 vmpool mirror /dev/sdb /dev/sdc

# Enable compression (saves space, negligible CPU cost)
zfs set compression=lz4 vmpool

# Register the pool with Proxmox
pvesm add zfspool vmpool --pool vmpool --content images,rootdir

# Verify storage is visible
pvesm status

If you have spinning HDDs for backups, create a separate pool just for that and add it as a directory storage:

# Create a pool for backups on HDDs
zpool create backup-pool mirror /dev/sdd /dev/sde
zfs set compression=lz4 backup-pool

# Register as Proxmox storage for backups and ISOs
pvesm add dir backup-storage --path /backup-pool --content backup,iso,vztmpl

Step 5: Networking — Bridges, Bonds, and VLANs

Proxmox uses Linux bridges to connect VMs to the network. The installer creates vmbr0 bridged to your primary NIC. For production, you want more than a flat bridge.

Here is a production network config with a bonded interface and VLAN-aware bridge:

# /etc/network/interfaces — bond + VLAN bridge

auto lo
iface lo inet loopback

# Bond interface (LACP)
auto bond0
iface bond0 inet manual
    bond-slaves enp1s0 enp2s0
    bond-mode 802.3ad
    bond-miimon 100
    bond-lacp-rate fast

# Management bridge
auto vmbr0
iface vmbr0 inet static
    address 192.168.1.10/24
    gateway 192.168.1.1
    bridge-ports bond0
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

# Restart networking
systemctl restart networking

With bridge-vlan-aware yes, you can assign VLAN tags to individual VM network interfaces from the web UI without touching the config file again.

Step 6: Creating Your First VM

First, upload an OS ISO. Download it directly from the Proxmox node or upload via the web UI:

# Download Ubuntu Server ISO directly on the Proxmox host
wget -O /var/lib/vz/template/iso/ubuntu-24.04-live-server-amd64.iso \
  https://releases.ubuntu.com/24.04/ubuntu-24.04-live-server-amd64.iso

# Refresh the ISO list in the web UI
pvesm scan

Now create a VM via the web UI or the command line:

# Create VM 100 with 4 cores, 8 GB RAM, 50 GB disk
qm create 100 --name ubuntu-server \
  --memory 8192 \
  --cores 4 \
  --net0 virtio,bridge=vmbr0 \
  --scsi0 vmpool:50,discard=on,ssd=1 \
  --cdrom local:iso/ubuntu-24.04-live-server-amd64.iso \
  --boot order=scsi0;ide2 \
  --agent 1

# Start the VM
qm start 100

# Open VNC console in CLI (or use web UI console)
qm vncproxy 100

The --agent 1 flag enables the QEMU Guest Agent, which gives you proper IP reporting, graceful shutdown, and freeze/thaw for consistent backups.

Step 7: Bonus — LXC Containers (Lightweight Alternative)

Not everything needs a full VM. For lightweight services (DNS, reverse proxy, monitoring), LXC containers use way less resources:

# Download an Ubuntu 24.04 LXC template
pveam update
pveam available | grep ubuntu-24
pveam download local:vztmpl/ubuntu-24.04-standard_24.04-1_amd64.tar.zst

# Create a container (ID 200) with 1 GB RAM, 8 GB disk
pct create 200 local:vztmpl/ubuntu-24.04-standard_24.04-1_amd64.tar.zst \
  --hostname dns-server \
  --memory 1024 \
  --cores 2 \
  --net0 name=eth0,bridge=vmbr0,ip=dhcp \
  --storage vmpool \
  --rootfs vmpool:8 \
  --password yourpassword

# Start and enter the container
pct start 200
pct enter 200

Step 8: Security Hardening

Here are a few essential hardening steps before putting Proxmox into production:

Firewall

Enable the Proxmox firewall at the datacenter level via the web UI (Datacenter > Firewall > Options > Enable: Yes). Then restrict SSH and web UI access:

# Allow only your management subnet
# /etc/pve/firewall/cluster.fw

[RULES]

# Allow HTTPS from management subnet
IN ACCEPT -source 192.168.1.0/24 -p tcp --dport 8006

# Allow SSH from management subnet only
IN ACCEPT -source 10.0.0.0/8 -p tcp --dport 22

# Drop everything else
IN DROP

# Apply the firewall rules
pve-firewall restart

TLS Certificate

Replace the self-signed cert with a Let’s Encrypt certificate. Proxmox has built-in ACME support:

# Set up ACME on the Proxmox host
pvenode acme account register default [email protected]

# Add DNS challenge (works even without port 80 open)
# Go to Datacenter > ACME > Add Challenge Plugin
# Then: Node > Certificates > Order Certificates Now

Two-Factor Authentication

Enable TOTP for the root account: Datacenter > Permissions > Users > root@pam > TOTP. Scan the QR code with your authenticator app.

Step 9: Automated Backups

Never skip backups. Proxmox has a built-in backup scheduler. Go to Datacenter > Backup and create a backup job:

• Storage: Pick your backup storage (separate ZFS pool or NFS share)
• Schedule: Daily at 2 AM
• Mode: Snapshot (no downtime)
• Compression: Zstd
• Prune: Keep last 7, keep last 4 weekly, keep last 3 monthly

If you run a Proxmox Backup Server (PBS), it is even better — it supports incremental backups, deduplication, and verified restores. You can set it up on a separate machine or even as an LXC container.

# Add PBS as a backup target from CLI
pvesm add pbs pbs-backup \
  --server 192.168.1.20 \
  --datastore main \
  --username root@pam \
  --password yourpbspassword \
  --fingerprint XX:XX:XX:XX:XX:XX:...

Production Checklist Summary

Here is a quick checklist I use before calling a Proxmox host production-ready:

• No-subscription repo configured, system fully updated
• Dedicated ZFS pool for VM storage (separate from OS disk)
• LZ4 compression enabled on all datasets
• Network bond configured (LACP if switch supports it)
• VLAN-aware bridge enabled
• Firewall enabled with management subnet whitelist
• Let’s Encrypt TLS certificate configured
• TOTP two-factor authentication enabled
• Automated backup job configured with retention policy
• Separate backup storage (not on the same disks as VMs)
• NTP configured to keep cluster time in sync
• Check Proxmox VE subscription status (free tier is fine for homelab)

Wrapping Up

Proxmox VE is one of those tools that keeps getting better. The web UI does not get in your way, ZFS snapshots make me sleep better at night, and clustering is straightforward when you need to scale. The community is also solid — the Proxmox forum and wiki have answers to almost any question you will run into.

Whether you are setting up a homelab for pentesting practice or running production workloads, the steps above will get you a solid, secure Proxmox host. Start with one node, get comfortable with the interface, then move on to clustering and high availability when you are ready.