New OS available: Proxmox Virtual Environment (VE) 9

As setting up Proxmox 9 to work on a Kimsufi server with a single external IP address was a bit of a nightmare, we wrote this cookbook.

Hope it helps

Walter

OVH/Kimsufi Proxmox Container Setup Guide

From Bare Metal to Working Web Server

Tested on: KS-5 server, Proxmox 9, September 2025

Overview

This guide documents the complete process of setting up working container networking on OVH/Kimsufi dedicated servers with Proxmox 9, from initial server provisioning to a functioning web server accessible from the internet.

Prerequisites

• OVH/Kimsufi dedicated server
• Proxmox 9 installed by OVH
• SSH access to the server
• Basic understanding of Linux networking

OVH/Kimsufi Proxmox 9 Container Setup Guide

From Bare Metal to Working Web Server

Tested on: KS-5 server, Proxmox 9, September 2025

Overview

This guide documents the complete process of setting up working container networking on OVH/Kimsufi dedicated servers with Proxmox, from initial server provisioning to a functioning web server accessible from the internet.

Prerequisites

• OVH/Kimsufi dedicated server
• Proxmox 9 installed by OVH
• SSH access to the server
• Basic understanding of Linux networking

Part 1: Initial Server Setup

1.1 Access and User Setup

# SSH into server as root
ssh root@YOUR_SERVER_IP

# Create admin user
adduser clubadmin
usermod -aG sudo clubadmin

# Set up SSH key access
mkdir -p /home/clubadmin/.ssh
cp /root/.ssh/authorized_keys /home/clubadmin/.ssh/
chown -R clubadmin:clubadmin /home/clubadmin/.ssh
chmod 700 /home/clubadmin/.ssh
chmod 600 /home/clubadmin/.ssh/authorized_keys

# Configure passwordless sudo
echo "clubadmin ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/clubadmin
chmod 440 /etc/sudoers.d/clubadmin

1.2 Proxmox Web Interface Access

Set password for root to access Proxmox web interface:

passwd root

Access Proxmox at: https://YOUR_SERVER_IP:8006

Part 2: Container Network Configuration

2.1 The Problem

Default Proxmox container networking on OVH fails because:

• Containers connect directly to external bridge (vmbr0)
• No NAT configuration for container traffic
• Missing FORWARD rules between internal and external networks

2.2 Create Internal Bridge Network

Edit /etc/network/interfaces and add:

auto vmbr6
iface vmbr6 inet static
    address 10.0.0.254/24
    bridge-ports none
    bridge-stp off
    bridge-fd 0
    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o vmbr0 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s 10.0.0.0/24 -o vmbr0 -j MASQUERADE

2.3 Activate Internal Bridge

# Bring up the new bridge
ifup vmbr6

# Verify bridge creation
ip addr show vmbr6

2.4 Configure Packet Forwarding

# Enable IP forwarding permanently
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p

# Add FORWARD rules for container-to-internet traffic
iptables -I FORWARD -i vmbr6 -o vmbr0 -j ACCEPT  
iptables -I FORWARD -i vmbr0 -o vmbr6 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Save iptables rules
mkdir -p /etc/iptables
iptables-save > /etc/iptables/rules.v4

Part 3: Container Creation

3.1 Download Container Template

In Proxmox web interface:

1. Navigate to node → local storage
2. Click "CT Templates" tab
3. Click "Templates" button
4. Download "ubuntu-22.04-standard"

3.2 Create Container via Web Interface

1. Right-click node name → "Create CT"
2. General tab:
   • CT ID: 100
   • Hostname: your-container-name
   • Set password
   • Add SSH public key
3. Template tab:
   • Select ubuntu-22.04-standard
4. Root Disk tab:
   • Size: 8GB (adjust as needed)
5. CPU/Memory tabs:
   • Set as needed (1 core, 1GB RAM for basic web server)
6. Network tab:
   • CRITICAL: Change bridge from vmbr0 to vmbr6
   • Set static IP: 10.0.0.100/24 (increment for additional containers)
   • Gateway: 10.0.0.254
7. DNS tab:
   • Use host settings

3.3 Container Network Verification

# Start container
pct start 100

# Enter container
pct enter 100

# Test connectivity
ping -c 3 10.0.0.254    # Gateway
ping -c 3 8.8.8.8       # Internet
wget --timeout=10 http://github.com  # HTTP connectivity

Part 4: Web Server Setup

4.1 Install Caddy in Container

# Download and install Caddy
wget -O /tmp/caddy.tar.gz 'https://github.com/caddyserver/caddy/releases/download/v2.7.6/caddy_2.7.6_linux_amd64.tar.gz'
tar -xzf /tmp/caddy.tar.gz -C /usr/local/bin/ caddy
chmod +x /usr/local/bin/caddy

# Verify installation
/usr/local/bin/caddy version

4.2 Configure Web Server

# Create directory structure
mkdir -p /etc/caddy /var/www/html

# Create test page
echo '<h1>Working Web Server</h1><p>Container networking successful!</p>' > /var/www/html/index.html

# Create basic Caddyfile
echo ':8080 {
    root * /var/www/html
    file_server
}' > /etc/caddy/Caddyfile

# Start Caddy
nohup /usr/local/bin/caddy run --config /etc/caddy/Caddyfile > /var/log/caddy.log 2>&1 &

Part 5: External Access Configuration

5.1 Port Forwarding Setup

# Exit container
exit

# Add port forwarding (external port 8080 → container port 8080)
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 10.0.0.100:8080
iptables -A FORWARD -p tcp -d 10.0.0.100 --dport 8080 -j ACCEPT

# Save rules
iptables-save > /etc/iptables/rules.v4

5.2 Test External Access

From external machine:

curl http://YOUR_SERVER_IP:8080

Part 6: Multiple Container Setup

6.1 Additional Containers

For each new container:

1. Use Proxmox web interface
2. Network: Bridge vmbr6, increment IP (10.0.0.101, 10.0.0.102, etc.)
3. Gateway: 10.0.0.254
4. Add port forwarding rules as needed

6.2 Port Forwarding for Additional Services

# Example: Forward port 8081 to second container
iptables -t nat -A PREROUTING -p tcp --dport 8081 -j DNAT --to-destination 10.0.0.101:80
iptables -A FORWARD -p tcp -d 10.0.0.101 --dport 80 -j ACCEPT

Conclusion

This configuration provides stable container networking on OVH infrastructure. The key insight is that containers need an internal bridge network with proper NAT and forwarding rules, rather than connecting directly to the external bridge.

After implementing this setup, containers have full internet connectivity and can be accessed from external networks through port forwarding rules. This solution eliminates the TCP connectivity issues that can occur with incorrect container networking configurations.