Firewall problem ?

[clgies]

After updating Veeam to Version 13, the Proxmox VE server is no longer reachable. Specifically, the Proxmox server cannot be reached from the Veeam Backup Server on TCP ports 8006 and 22.

Veeam reports:
Backup Infrastructure → Proxmox unavailable

• Veeam Backup & Replication: Version 13.0.2.29, IP 192.168.110.79
• Proxmox VE: Version 8.2.7, IP 192.168.110.106

The following connectivity tests fail with a timeout:

On the Proxmox server:

tcpdump -nn -i eno1 host 192.168.110.79

On the Veeam Backup Server:

Test-NetConnection 192.168.110.106 -Port 8006

Test-NetConnection 192.168.110.106 -Port 22

curl.exe -vk https://192.168.110.106:8006

Firewall Configuration​

Veeam Backup Server (192.168.110.79)

The Windows Firewall is disabled:

Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False

Proxmox VE Server

The Proxmox firewall is disabled:

systemctl stop pve-firewall

Additional verification:

• iptables is not filtering any traffic (default policy: ACCEPT).

root@proxmox:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source

• nftables contains no rules.

Veeam Worker VM

The VM firewall is disabled:

qm set 103 --net0 virtio=BC:24:11:9C:01:EE,bridge=vmbr0,firewall=0

Successfully Verified​

1. Proxmox Ports and Services​

root@proxmox:~# ss -tlnp | egrep ':22|:8006'


LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users("sshd",pid=1486,fd=3))

LISTEN 0      128             [::]:22           [::]:*    users("sshd",pid=1486,fd=4))

LISTEN 0      4096               *:8006            *:*    users("pveproxy worker",pid=614596,fd=6),("pveproxy worker",pid=613380,fd=6),("pveproxy worker",pid=612830,fd=6),("pveproxy worker",pid=612829,fd=6),("pveproxy worker",pid=558100,fd=6),("pveproxy",pid=552469,fd=6))

2. DNS Resolution and Routing​

Verified and functioning correctly.

3. Direct Access to Proxmox VE​

The Proxmox VE web interface is accessible from other systems on the network at:

https://192.168.110.106:8006

This indicates that the Proxmox server itself is operational and that the issue appears to be specific to communication between the Veeam Backup Server and the Proxmox VE host.

What could be the cause? I would be grateful for any help. Cheers, Claus

 

[clgies]

Another observation:

Sometimes the connection works, and sometimes it doesn't:

PS C:\WINDOWS\system32> Test-NetConnection 192.168.110.106 -Port 8006


ComputerName     : 192.168.110.106
RemoteAddress    : 192.168.110.106
RemotePort       : 8006
InterfaceAlias   : Ethernet
SourceAddress    : 192.168.110.79
TcpTestSucceeded : True



PS C:\WINDOWS\system32> Test-NetConnection 192.168.110.106 -Port 8006
WARNUNG: TCP connect to (192.168.110.106 : 8006) failed


ComputerName           : 192.168.110.106
RemoteAddress          : 192.168.110.106
RemotePort             : 8006
InterfaceAlias         : Ethernet
SourceAddress          : 192.168.110.79
PingSucceeded          : True
PingReplyDetails (RTT) : 0 ms
TcpTestSucceeded       : False

 

[clgies]

Further observation:

After the dynamic IP on the backup server (192.168.110.79, reserved on the DHCP server) was replaced with a different static IP (192.168.110.116), communication was possible again

However, we were able to rule out an address conflict (192.168.110.79).

Could a firewall on the VeeamWorker VM be the cause?

It's a mystery.

Cheers Claus

 

[clgies]

After testing the connection from the backup server to the Veeam worker within Veeam Backup (Backup Infrastructure -> Backup Proxies), the connection from the backup server to the Proxmox server suddenly became unavailable.

 

[clgies]

After reconnecting Proxmox VE within Veeam Backup, backups and communication between the backup system (Veeam) and the Proxmox server functioned smoothly again.

Procedure:

1. Remove the Veeam Worker Proxy (Veeam: Backup Infrastructure -> Backup Proxy)
2. Remove Proxmox VE from the inventory
3. Remove the Veeam Worker VM from Proxmox VR
4. Add Proxmox VE from the inventory
5. Deploy VeeamWorker to Proxmox VE