PVE LXC Tag
Install a host service that writes the IP addresses of containers and VMs into their Proxmox tags and keeps them current.
add-iptag.sh installs IP-Tag on the host. IP-Tag looks up the IPv4 addresses of all LXC containers and VMs and sets them as tags, so the address is visible next to each guest in the Proxmox web interface. It can run as a systemd service that repeats the check, or as a command you start yourself.
Website entry: add-iptag. Source: tools/pve/add-iptag.sh.
Run
In the Proxmox VE host shell, as root:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/add-iptag.sh)"Prompts
All prompts are plain text.
Choose action
| Choice | Meaning |
|---|---|
1 Install with automatic service (recommended) | Installs the script, the configuration, the iptag.service unit and the iptag-run command, and starts the service. |
2 Install command only (manual execution) | Installs the script, the configuration and iptag-run. No service. |
3 Update existing installation | Stops the service, rewrites the script, the unit file and iptag-run, and starts the service again. Asks Do you want to replace it with defaults? (y/n) for an existing configuration. |
4 Cancel | Exits. |
For 1 and 2 the script then asks Proceed? (y/n), checks the Proxmox VE version (8.0 to 8.4 or 9.x; otherwise it exits) and installs the packages ipcalc and net-tools.
Configuration setup (asked when no configuration exists, or when you agree to reconfigure an existing one)
| Prompt | Choices | Default |
|---|---|---|
Enter your choice (1-3) [1]: | 1 last_two_octets (for example 0.100), 2 last_octet (100), 3 full (192.168.0.100) | 1 |
Enter interval in seconds [300]: (not asked for choice 2 of the action menu) | A number from 300 to 7200 | 300 |
With an existing configuration, choices 1 and 2 ask Do you want to reconfigure tag format and loop interval? (y/n) or Do you want to reconfigure tag format? (y/n). Anything but y keeps the file.
Files and service
| Path | Purpose |
|---|---|
/opt/iptag/iptag | The IP-Tag script. |
/opt/iptag/iptag.conf | Configuration. |
/usr/local/bin/iptag-run | Runs one check and exits (sets FORCE_SINGLE_RUN=true). |
/lib/systemd/system/iptag.service | Service, enabled and started by choices 1 and 3. |
With choices 1 and 2, a configuration file from an older version at /opt/lxc-iptag is copied to /opt/iptag/iptag.conf and removed.
Configuration
/opt/iptag/iptag.conf as generated (comments omitted):
CIDR_LIST=(
192.168.0.0/16
10.0.0.0/8
100.64.0.0/10
)
TAG_FORMAT="last_two_octets"
LOOP_INTERVAL=300
DEBUG=false| Key | Meaning |
|---|---|
CIDR_LIST | Only addresses inside one of these networks become tags. Adjust it to your subnets. |
TAG_FORMAT | last_two_octets, last_octet or full. |
LOOP_INTERVAL | Seconds between two checks of the service. |
DEBUG | true prints the detection steps to the service log. |
Restart the service after editing:
systemctl restart iptag.serviceHow addresses are found
| Guest | Sources |
|---|---|
| LXC, running | Static ip= values from the container configuration; if there are none, the host's neighbour table (ip neighbor show) matched by the container's MAC address; in addition ip -4 addr show inside the container through pct exec. |
| VM, running | With the guest agent enabled in the VM configuration: qm guest cmd <id> network-get-interfaces, at most three addresses inside CIDR_LIST. Otherwise, or if that gives nothing: the neighbour table by MAC address, verified with one ping; then DHCP lease files on the host. |
| Stopped guests | No address. |
On every check, tags that look like an IP address or like dotted numbers are treated as IP tags and replaced by the current set; all other tags are kept. The tags are written with pct set <id> -tags or qm set <id> --tags.
Undo
The script has no uninstall option. To remove IP-Tag:
systemctl disable --now iptag.service
rm -f /lib/systemd/system/iptag.service /usr/local/bin/iptag-run
rm -rf /opt/iptag
systemctl daemon-reloadTags that were already set stay on the guests until you remove them.
Environment variables
| Variable | Default | Purpose |
|---|---|---|
COMMUNITY_SCRIPTS_CORE_URL | https://raw.githubusercontent.com/community-scripts/core/main | Base URL the installer loads api/api.func from. |
FORCE_SINGLE_RUN | unset | Read by /opt/iptag/iptag. true makes it run one check and exit; iptag-run sets it. |
Limits
- IPv4 only.
- Whenever the configuration is regenerated (new install, reconfigure, replace with defaults),
CIDR_LISTis reset to the three default networks. Re-add your own subnets afterwards. - Any existing tag that consists only of digits and dots, such as a version number, is treated as an IP tag and removed.
- An LXC container for which no address is found keeps its tags. A VM without a detectable address, including a stopped VM, loses its IP tags.
- For a VM without guest agent the address comes from the host's neighbour table, so it is only found after the VM has talked to the host's network.
- Proxmox VE 8.5 to 8.9 are rejected by the version check of the installer.