QNAP via ISCSI as a Backup Repository

[SEC-Sturm]

Hello everybody,
thank you for inclusion in the forum.

I've recently started working on Veeam Backup & Replication,
read forum entries, descriptions and watch the webinars.

I installed Veeam Backup & Replication on a test system to deal with it.
The test system looks like this:

- HP Server Proliant DL380 Gen9
- Microsoft Windows 2019 standard (Hyper-V host)
- 3 VMs, Exchange, domain controller, RDP server; all servers based on Server 2016 standard.

A SOHO-QNAP-NAS is connected to the Hyper-V host via ISCSI.
This is a TS-253Pro with 2 8TB hard drives.
The released and integrated LUN has 4TB storage space. The network speed is 1GB/s.

I would like to use the NAS server as a backup repository and have been reading some descriptions and forum entries for two days, but I have a few questions.

If I connect the NAS server via ISCSI, I have to integrate the drive in Windows on the Hyper-V host, on which Veeam Backup & Replication is also installed, and assign it a drive letter so that I can see it in Backup & Replication.
However, this may be a security vulnerability, if the drive is integrated in Windows, in the worst case, a hacker attack or a Cryptolocker should occur.

Can I connect the NAS server directly as a backup repository via ISCSI without creating a Windows drive?
I find various solutions for this in the forums, but I do not "see" the drive in Backup & Replication if it does not have a drive letter.

The whole thing would work via SMB or NFS, but the backup speed is much slower than via iscsi.

Can you help me here?

Do I need another program, license, etc. so that I can integrate the NAS server directly into Backup & Replication via ISCSI?
Or does that not work in my case with the SOHO NAS server?

Thank you very much in advance for your answers and your support.

greetings
Marcus

[HannesK]

Hello,
To answer your question: malware can always access an iSCSI drive.

Best practice: the Veeam server should be installed inside a VM. And then I would connect the iSCSI LUN directly to the VM. Yes, go with iSCSI and REFS. If you don't join the backup server to the domain and use good passwords, then you reduce chances of malware on the backup server significantly.

Currently I don't see a backup copy in your design. You could leverage capacity tier in copy mode (available with V10 next week) and use a cloud provider with object storage. Chances are low that malware will access object storage. If you want to be 100% safe, then choose a cloud provider that supports S3 object lock (I know that Amazon and Wasabi support it, but there might be more)

Best regards,
Hannes