Veeam Proxy Ports
You configure veeam proxy ports by opening network paths between backup servers and storage nodes. These rules let data move from source hosts to target disks during backup jobs. Most teams start by opening wide port ranges across whole subnets to speed up deployment. That broad setup works at first, but it leaves servers exposed to lateral network movement. When a team grants wide network rules and shared admin keys, risks grow fast. Any user or script on that subnet can reach the backup hosts
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You configure veeam proxy ports by opening network paths between backup servers and storage nodes. These rules let data move from source hosts to target disks during backup jobs. Most teams start by opening wide port ranges across whole subnets to speed up deployment. That broad setup works at first, but it leaves servers exposed to lateral network movement. When a team grants wide network rules and shared admin keys, risks grow fast. Any user or script on that subnet can reach the backup hosts without strict checks.
How veeam proxy ports work in backup setups
A backup system relies on control channels and data channels to move virtual machine snapshots. The main backup server talks to the worker node over a fixed control port. Once the job starts, the worker node opens dynamic data ports to stream disk blocks. Those blocks flow from the hypervisor to the worker node and then to storage.
To set this up, admins define firewall rules on both Windows and Linux hosts. You must allow inbound control traffic from the central management server to each worker node. You also need a pool of data ports open between the worker and the repo. The size of this port pool depends on how many backup tasks run at once. Each active virtual disk uses its own network stream during the backup window.
When you deploy a new worker node, the management server pushes software over admin shares. This step requires standard system management ports to keeps the session active during the install phase. Many teams leave these install ports open all the time on every backup host. Leaving those ports open gives attackers a clear path if they steal a domain key.
What native network rules solve and what they miss
Firewall rules for backup traffic do a good job of blocking random network scans. When you restrict source and destination IP addresses, outside hosts cannot reach the data streams. You can also separate backup traffic onto a dedicated VLAN to keep production networks fast. This network split stops normal app servers from talking to your backup storage nodes.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Still, network port rules and local host roles only decide who can log in. They do not inspect or control what an engineer does after the session starts. Admins still need direct shell or remote desktop sessions to fix failed backup jobs. They log in with high-level roles to check logs, restart services, or test disk mounts.
Once an admin logs into a worker host, the firewall does not see their commands. A shared admin account leaves no clear record of which person ran a destructive command. If someone queries a local config database, raw secrets or emails can appear on screen. Native host settings cannot rewrite phone numbers or card numbers in command outputs in flight. Teams also struggle to require peer approval before an engineer runs a risky storage command. To close this gap, you need controls that work at the command and query level.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Why do backup worker nodes need a range of data ports?
Each concurrent backup task opens a separate network stream to move disk data fast. A defined port range ensures the host has enough open channels for parallel jobs.
Should we leave deployment ports open after installing a backup node?
No, you should close deployment and file share ports once the node is running. You only need to open them again when you push software updates to the host.
How can we limit risk when admins log into backup servers?
Remove standing local admin accounts and tie every login to an individual identity provider user. Log every command in real time and require approval for sensitive maintenance actions.