backup in repository veeam backup

[crazych]

Hello

How do I create a task for a repository located behind nat?
17.02.2021 19:08:35 :: Failed to connect to the port [192.168.1.6:2500]

a different ip is specified in the backupserver field
where can I change this setting?

[Mildur]

Veeam Agents doesn‘t go well with NAT. It‘s not supported with the default vbr+agent installation.

The only supported solution is targeting a cloud backup repo. For that, you need to be a service provider. Or get in touch with a registered service provider.

You can find out about this here
veeam-agent-for-windows-f33/featurerequ ... 51473.html


From the guide:

https://helpcenter.veeam.com/docs/agent ... tml?ver=40

Network

Consider the following:
Veeam Agent for Microsoft Windows should be able to establish a direct IP connection to the Veeam Backup & Replication server. Thus, Veeam Agent cannot work with Veeam Backup & Replication that is located behind the NAT gateway.

[aj_potc]

I tested a similar setup a couple of years ago in which my Veeam B&R server was behind a NAT, and I wanted to back up remote agents. As @Mildur has suggested, things did not go well.

As with your example, I kept seeing in the logs that the agent was trying to connect to the B&R server using its private IP address, which of course won't work. As a workaround, Veeam support suggested I set up a VPN between the agent and B&R server. In the end, I gave up with that approach; the extra complexity wasn't worth the trouble.

If your B&R server has a public IP, however, then things work quite well. You can achieve this by setting up a Windows VPS on a cloud provider and running the VBR on it. It doesn't have very high resource requirements, so you don't need a monster server. Maybe that's worth a try in your case?

[shkodik]

On linux, you can use iptables to solve this problem. Just redirect traffic from local ip to external.
here's an example:

Code: Select all

iptables -t nat -I OUTPUT -d local-ip/32 -p tcp -m multiport --dports 2500:3300 -j DNAT --to-destination external-ip

[jeffshead]

iptables -t nat -I OUTPUT -d local-ip/32 -p tcp -m multiport --dports 2500:3300 -j DNAT --to-destination external-ip

How safe is this? Is the traffic encrypted?

[aj_potc]

How safe is this? Is the traffic encrypted?

I have the same concern.

I've read that, by default, Veeam encrypts traffic heading for external destinations, so I'd assume that traffic redirected in this way may not be encrypted.

It would be good to hear from someone with more detailed knowledge of the software for an authoritative answer.

[PTide]

Hi,

Encryption rules are defined by these settings, so adjust them accordingly.

Thanks!