Proxmox VE on ousfifty's blog

Advanced FnOS Configuration and Usage Tips

Fri, 08 Aug 2025 11:26:29 +0800

This article focuses on optimizing FnOS. For instructions on installing FnOS on PVE or a physical machine, please see the previous article.

Network Optimization

The following optional steps can improve network throughput and privacy.

Execute this script to enable the BBR congestion control algorithm:

cat > /etc/sysctl.d/99-enable-bbr.conf <<EOF
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF

Apply the BBR configuration without rebooting:
```
sysctl -p /etc/sysctl.d/99-enable-bbr.conf
```

Execute this script to enable modern IPv6 privacy address standards (RFC 7217 and RFC 4941):

cat > /etc/sysctl.d/99-enable-private-ipv6.conf <<EOF
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
net.ipv6.conf.all.addr_gen_mode=1
net.ipv6.conf.default.addr_gen_mode=1
EOF

Apply the sysctl configuration:
```
sysctl -p /etc/sysctl.d/99-enable-private-ipv6.conf
```
🚨 Warning: Do not use the “EUI-64” option in the FnOS web interface. Doing so will negate these privacy enhancements by exposing the device’s MAC address in its IPv6 address.
Applying Network Changes

To activate the new IPv6 address settings, the network interface must be reset. This can be done with nmcli without a full system reboot.

🚨 Important: Execute these commands from the PVE web console (Xterm.js), as running them over SSH will cause a disconnection due to the IPv6 address change and may not be recoverable.

Step 1: Identify the Connection Name List all active connections to find the name of your primary interface.
```
nmcli connection show
```
The output will list available connections. Note the name of your Ethernet connection, which is often Wired connection 1.

Step 2: Reset the Connection Use the identified name to restart the network interface:
```
nmcli connection down "Wired connection 1" && nmcli connection up "Wired connection 1"
```
The network interface will restart. You can confirm the new IPv6 address configuration using ip a or in the Summary page for the VM in the PVE web console.

Enabling IPv6 Router Advertisements (RA) for Hosted Virtual Machines

To allow VMs inside it to also acquire IPv6 addresses via SLAAC, its RA settings must be changed:

cat > /etc/sysctl.d/99-virtual-machine.conf <<EOF
net.ipv6.conf.all.accept_ra = 2
net.ipv6.conf.default.accept_ra = 2
EOF

sysctl -p /etc/sysctl.d/99-virtual-machine.conf

Enabling Memory and CPU Hot-plug as a PVE/QEMU Guest

Modify /etc/default/grub to enable memory hot-plug:

- GRUB_CMDLINE_LINUX="modprobe.blacklist=pcspkr"
+ GRUB_CMDLINE_LINUX="modprobe.blacklist=pcspkr memhp_default_state=online"

Create a UDEV rule to enable CPU hot-plug:

cat > /lib/udev/rules.d/80-hotplug-cpu.rules <<EOF
SUBSYSTEM=="cpu", ACTION=="add", TEST=="online", ATTR{online}=="0", ATTR{online}="1"
EOF

Shut down the virtual machine.
In the PVE web console, on the Processor page, check “Enable NUMA”.
In the PVE web console, on the Options page, check Memory and CPU in the “Hotplug” options list.

Installing FnOS on Proxmox VE (PVE)

Sun, 03 Aug 2025 10:12:00 +0800

Introduction

This document addresses common issues encountered on the process of installing FnOS in a PVE environment, such as a locked system and an unresponsive PVE web console. By following these steps, you will achieve a fully accessible, secure, and optimized FnOS virtual machine.

If you have already completed the installation and want to see more optimization tips, please see this article.

Pre-Installation

FnOS ISO: Visit https://www.fnnas.com/ and obtain it via “Direct Download”.

It is recommended that the FnOS VM has at least 3GB of RAM and 2 cores.

Follow the official guide to install the system.

Post-Installation Configuration

On the first boot, two primary issues prevent access to the new FnOS instance:

Login Disabled: The system console does not accept any credentials (including root) until the web-based initial setup is complete. This is problematic for remote machines that may only have IPv6 access.
Unresponsive PVE Console: The Xterm.js serial console in the PVE web UI does not work by default.

The following sections provide solutions to these problems.

1. Gaining Initial Root Access

First, we must bypass the standard boot sequence to set a root password.

In the PVE console, restart the VM. At the GRUB boot menu, press e to edit the boot parameters.
Find the line that begins with linux. It will look similar to this:
```
linux /boot/vmlinuz-6.12.18-trim root=UUID=... ro quiet
```
At the end of this line, add single init=/bin/bash. This parameter boots the system directly into a root shell.
Press Ctrl+X or F10 to boot.
In the root shell, execute the passwd command to set a new password for the root user.
Once done, reboot the VM. The boot parameter change is temporary and will not persist.

2. Enabling Permanent Console Access and Functionality

With root access established, permanently modify the GRUB configuration to enable the PVE serial console and other features.

Log in as root with the newly set password.
Edit the GRUB configuration file: nano /etc/default/grub.

Modify the GRUB_CMDLINE_LINUX_DEFAULT line to include serial console and optional nested virtualization IOMMU support.

For Intel CPUs:

- GRUB_CMDLINE_LINUX_DEFAULT="quiet"
+ GRUB_CMDLINE_LINUX_DEFAULT="quiet console=tty0 console=ttyS0,115200 intel_iommu=on iommu=pt"

For AMD CPUs:

- GRUB_CMDLINE_LINUX_DEFAULT="quiet"
+ GRUB_CMDLINE_LINUX_DEFAULT="quiet console=tty0 console=ttyS0,115200 amd_iommu=on iommu=pt"

Note: console=ttyS0,115200 is the key parameter for PVE Xterm.js functionality.

Save the changes and exit the editor.
Apply the new configuration by executing:
```
update-grub
```
Reboot the VM. The PVE web console should now be fully functional.

3. Installing the QEMU Guest Agent

For better integration with PVE, such as displaying network information in the VM summary, we need to install the qemu-guest-agent.

```shell
apt update && apt -y install qemu-guest-agent
systemctl enable --now qemu-guest-agent
```

Conclusion

You have successfully configured an FnOS instance on Proxmox VE. The system is now fully accessible and properly integrated with the PVE host. Further configurations and optimizations will be presented in a new article.