How does an extra IPv4 reach a Proxmox guest when there is no subnet?

vmbr0 bridge or NAT depends on the address count

Guides usually offer two pictures: attach the guest to vmbr0, or NAT it behind the host. Both can boot a guest. On this machine the choice follows the address list. The console may put several addresses in one string, separated by commas, spaces, or semicolons. Split that string. The first address is the management address, and SSH uses only that one. Later addresses are the ones a guest may hold.

The included address cannot be both the host login and the guest’s only public address. Moving it off vmbr0 into a guest removes SSH to the host. Each extra address belongs to one guest. When the extra count is zero, the guest keeps a private address and the outside world arrives through a chosen port on the management address. That is NAT. When extra addresses exist, the guest does not join vmbr0 inside a prefix this order does not have. An internal bridge with no physical port carries each address as a /32.

Which name, certificate, or allow-list receives which address is a separate note: assign each extra address to a service. This note only covers the path into a Proxmox guest.

Leave the management address on the host

Select Proxmox VE 8 or Proxmox VE 9 when ordering. Both images are already in the system list. After delivery, SSH to the management address. A USB installer is not part of this setup, and the network does not need to be chosen again in an installer.

Read the live configuration before editing files. In ip -4 addr, the address used for SSH should sit on vmbr0. In ip route show default, the gateway is the address after via, and dev should name vmbr0. That pair is the management configuration the image already applied. The prefix may not be /32. Leave it. Do not rewrite it as the /24 or /28 from a guide. The physical port is the name already written in bridge-ports inside /etc/network/interfaces. Do not replace it with eth0 or ens3 unless ip link shows that name.

An extra address is sometimes already an alias on the same bridge, and sometimes it exists only in the delivery note. Count global-scope IPv4 addresses. The count equals 1 plus the extra quantity on the order. If it is short, stop and open a ticket. Do not borrow an address from another machine. Once the count matches, remove the addresses that will move to guests from the host configuration, and keep the management address. One address cannot be an alias on the host and an address on the guest at the same time. Inbound traffic would hit the host, and the service inside the guest would see nothing.

Why a subnet guide boots the guest and then strands it

A general guide assumes the facility already placed a whole prefix on vmbr0, with the gateway as the first address of that prefix. The guest picks another address and copies the host mask. The guest NIC shows as up, because an address was written on the interface. On the way out, the guest treats the gateway as on-link and sends ARP. That prefix is not present on this machine, so nothing answers ARP, and the default route never becomes usable. From outside, the guest is powered on and the port is closed.

Another write-up attaches the guest to vmbr0, fills in the extra IPv4, copies the host gateway, and still uses /24 or /28. Extra addresses are single addresses. They are not a prefix to subdivide. Upstream delivers them to this machine, not to a guest MAC that tries to claim the gateway. ARP from the guest on vmbr0 never reaches the real next hop, or the return traffic still lands on the old alias on the host. The address is visible. ping does not leave.

A third stack turns on source NAT while the guest also believes it owns a public address. Outbound packets are rewritten to the management address, and return traffic no longer matches the session on the guest. An address that should stand alone is not source-natted. A guest that is reached by port forward does not also receive a public address. The two patterns do not share one address.

Hand each extra address to an internal bridge as /32

Name the internal bridge vmbr1. It has no physical port. It only connects the host and the guests. Append it to /etc/network/interfaces. The private range can change, but the host and the guest must share it. If 10.10.10.0/24 is already in use, pick another private range. 203.0.113.20 below is a documentation address. Replace it with one extra address from the order, one route per address.

The host stanza needs auto vmbr1, address 10.10.10.1/24, bridge-ports none, bridge-stp off, and bridge-fd 0. Each extra address adds post-up ip route add 203.0.113.20/32 dev vmbr1. Do not point via at a guest address that does not exist yet. With the route aimed at the bridge, the guest that holds the /32 answers ARP on that bridge.

Forwarding and reverse-path checks go in /etc/sysctl.d/99-guest-route.conf, then sysctl --system. The lines are net.ipv4.ip_forward=1, net.ipv4.conf.all.rp_filter=2, and the same rp_filter=2 on vmbr0 and vmbr1. With forwarding off, the host can reach the guest, and the guest still cannot reach the outside. Strict reverse-path filtering drops this traffic: the extra address lives on the guest, while the reply leaves through vmbr0, and strict mode decides the source does not belong to that exit. Loose mode covers that check. It does not replace a firewall.

Apply the interfaces file with ifreload -a. Then run a command in the existing SSH session and confirm the management address is still on vmbr0. ip route get 203.0.113.20 should print dev vmbr1. A route added only in the current shell, and not in the file, disappears after reboot, and the guest is stranded again.

In Proxmox, set the guest NIC bridge to vmbr1 and the model to VirtIO. There is no NAT switch on that NIC. Inside the guest, configure the public address as /32, with both the point-to-point peer and the default gateway set to 10.10.10.1. A Debian-style interfaces file uses address 203.0.113.20/32, pointopoint 10.10.10.1, and gateway 10.10.10.1. Ubuntu netplan uses the same /32, a default route via 10.10.10.1, and on-link: true. Filling only the Cloud-Init fields in Proxmox with a /32 and a gateway often omits that on-link route, so the guest still ARPs for a gateway that is not on the link. Write the guest’s own network file, reboot the guest, and read ip route.

A guest that needs its own public identity uses one extra address. The next guest uses the next extra address, still on vmbr1, with one more /32 route. Do not place several guests inside an invented /28. On the guest, ip route get 1.1.1.1 should show src as the public address, not 10.10.10.2. If the source is still private, the outside world sees the management address, and this step is not finished.

With no extra address, forward ports and stop there

When the extra count is zero, do not configure a public address on the guest. vmbr1 still uses 10.10.10.1/24. The guest uses one address in that range, for example 10.10.10.2/24, with gateway 10.10.10.1. The guest has no public identity of its own. A service on the guest is reached by forwarding one port from the management address to that private address.

Put the rules in post-up on the host’s vmbr1 stanza so they survive reboot. Inbound example: iptables -t nat -A PREROUTING -d MANAGEMENT -p tcp --dport 443 -j DNAT --to-destination 10.10.10.2:443. Outbound example: iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE. On Proxmox VE 8 and 9 these commands go through iptables-nft. Check with -C before -A, and skip the append when the rule already exists. Otherwise each ifreload stacks another copy.

Do not forward TCP 22 on the management address. That is SSH to the host. Sites, APIs, and a guest’s own remote desktop use some other external port. A Windows guest that needs RDP can receive a chosen port on the management address, forwarded to 3389 on that guest. Port 22 on the host stays where it is. The service inside the guest must listen on the private address or on every address. If it listens only on a public address that was never configured, the forward has no process to reach.

Port forwarding does not add addresses, and it does not raise the port rate. 250M, 1G, and 2G are a separate line, and none of them meters transfer. Ten guests leaving through the management address still show that one source. When another party’s allow-list requires a distinct source per service, return to the previous section and buy extra addresses one by one. Forwarding rules do not invent a subnet.

Check three times from outside the facility

1. The management address still logs in

   From an office or home network, SSH to the first address. The session must land on the host, not on a guest. Do not paste the whole console string into SSH.

2. Each extra address lands on its guest

   Open the real service on every extra address that should be in use. On the host, ip route get points at vmbr1. On the guest, ip -4 addr shows the /32. A curl of the host’s own address from the host often stays on the loopback and says nothing about the outside path.

3. With no extra address, check the port

   From outside, the forwarded port must answer from the guest. Port 22 on the host must still answer from the host. Both have to work. The forward must not have replaced the login path.

4. Reboot and read it again

   Reboot the host. The management address, the internal bridge, the /32 routes, or the port forwards must still be there. sysctl net.ipv4.ip_forward must be 1. If any piece is missing, fix the interfaces file. Do not only retype the command in this session.

If the address and the route are right and the outside path is still closed, look at the firewall. With the datacenter or node firewall enabled, the forward chain can drop on the default policy. While tracing, the firewall on that one guest NIC can be turned off. After the path works, allow the specific ports. Do not leave filtering off on the whole host as a shortcut.

Inside the guest the NIC may be ens18 or eth0. Use the name from ip link in that guest. A wrong name means the address never appears, and the route command will not say that a subnet is missing. Confirm the interface is up, then confirm the default route’s next hop is 10.10.10.1.

The count and the monthly rent move together

Each extra IPv4 is $2 a month. The order records a count, not a prefix length. Four addresses add $8 a month. Twenty add $40 a month. Together with the one included address, the total stays at or below 256. Those addresses join the machine, the disks, the bandwidth, and the system in one monthly rent, then the month count applies. Quarterly is three times the monthly rent, six months is six times, and a year is twelve times. No further discount applies. There is no setup fee.

The 128GB machine is $455 a month and already includes one IPv4 and 250M. The 256GB machine is $612 a month, with the same address rule. Both are AMD EPYC 7543P, 32 cores and 64 threads, with DDR4-3200 ECC RDIMM. 256GB is that model, not extra memory added to the 128GB machine. The memory tier does not include more addresses. Raising the port to 1G adds $248 a month and leaves the address count unchanged.

The machine is deployed in Tokyo, Japan. SSH to the host uses the management address shown in the console. A Windows guest uses RDP on that guest. It does not replace the host’s management address. Proxmox VE 8 and 9 are both in the free image list and are delivered as the installed system, not as separate install media.