Post-Install: Network

Force APT to use IPv4

Writes Acquire::ForceIPv4 "true"; to /etc/apt/apt.conf.d/99-force-ipv4. APT then refuses to use IPv6 for package downloads, even if the host has IPv6 connectivity.

Apply network optimizations

Writes a curated sysctl profile to /etc/sysctl.d/99-network.conf covering core socket buffers, ICMP hardening, basic spoof protection, and TCP buffer sizes that make sense on a hypervisor with lots of concurrent flows.

What gets tuned

It also adds source /etc/network/interfaces.d/* to /etc/network/interfaces if not already present — standard practice so you can drop modular interface snippets without editing the main file.

Automatic tuning of virtual firewall bridges

Alongside the sysctl profile, ProxMenux installs a helper at /usr/local/sbin/proxmenux-fwbr-tune that applies rp_filter=0 and log_martians=0 to the fwbr* / fwln* / fwpr* / tap* interfaces Proxmox creates around VMs and containers. The helper is invoked by the proxmenux-fwbr-tune.service one-shot unit at boot, and by the /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules rule on every net add event matching those prefixes — covering interfaces that Proxmox recreates on VM start/stop, reboot and live migration.

Install Open vSwitch

Installs openvswitch-switch + openvswitch-common. These packages add OVS as a bridge implementation alternative to the standard Linux bridges that Proxmox uses by default. The install alone doesn't change any networking — existing vmbrX bridges keep working. OVS becomes available in the Proxmox UI when you create a new bridge and pick it from the type dropdown.

# After moving bridges off OVS:
apt purge openvswitch-switch openvswitch-common
apt autoremove --purge

Enable TCP BBR + TCP Fast Open

Writes two sysctl files and reloads them. BBR replaces the default CUBIC congestion control with Google's bandwidth-based algorithm, which handles long-fat pipes and lossy links much better. TCP Fast Open (TFO) eliminates a round trip on repeat TCP connections by piggy-backing data on the SYN.

# /etc/sysctl.d/99-kernel-bbr.conf
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# /etc/sysctl.d/99-tcp-fastopen.conf
net.ipv4.tcp_fastopen = 3        # enable TFO for both client and server sockets

Verification

# BBR is active
sysctl net.ipv4.tcp_congestion_control
# Expected: net.ipv4.tcp_congestion_control = bbr

# Qdisc is fair queuing (required for BBR to work well)
tc qdisc show | head

# TFO enabled (value 3 = client + server)
sysctl net.ipv4.tcp_fastopen

rm /etc/sysctl.d/99-kernel-bbr.conf /etc/sysctl.d/99-tcp-fastopen.conf
sysctl --system

Interface Names (persistent)

Iterates over every physical NIC the host has (skipping loopback, Docker veths, bridges, TAP devices, bonds, Cilium, ZeroTier, WireGuard) and writes a systemd .link file binding the current interface name to the current MAC address. The kernel's naming logic can then no longer rename that NIC — the MAC wins.

Why this matters

• Adding or removing PCIe devices can shift the bus numbering, turning enp3s0 into enp4s0. If your /etc/network/interfaces references the old name, the bridge vanishes on reboot.
• BIOS / firmware updates sometimes change how devices enumerate, with the same effect.
• LXC containers with hotplug NICs and bonded links can race on boot and end up named inconsistently. Pinning fixes that.

What gets written

One file per physical NIC, at /etc/systemd/network/10-proxmenux-<iface>.link. Each file starts with the header # Managed by ProxMenux — do not edit so ProxMenux can distinguish its own files from user- or package-provided .link files.

[Match]
MACAddress=aa:bb:cc:dd:ee:ff

[Link]
Name=enp3s0

.link files from other packages or hand-written by the user are left in place — only files carrying the ProxMenux header are managed. On re-run, the function reconciles its own set: it re-reads MACAddress= from every 10-proxmenux-*.link and drops any whose MAC no longer appears under /sys/class/net/. Files written by an earlier ProxMenux release in the old 10-<iface>.link format are migrated automatically the first time.

Related

• Network Management — diagnostics, bridge analysis, guided repairs.
• Persistent interface names — same idea exposed as its own menu later (use either, not both).
• Network commands reference — ip, ss, ethtool, sysctl.
• Uninstall Optimizations — revert any of these network changes.
• Customizable Post-Install — back to the parent menu.