Hardened Repo - Not Working in Isolated Subnet Port 2500

Did you put the exclusions in the Ubuntu firewall?  You can use the Test-NetConnection from the VBR server to the repo server using port 2500 as a test.  It is definitely a network routing or firewall blocking issue.

Thank you for your reply.

Ufw is disabled at the moment. Also strange how simply moving subnets makes everything work just fine. Nothing else changed. 

I believe there are more than just port 2500 that is needed.  I would check the ports site here - https://helpcenter.veeam.com/docs/vbr/userguide/used_ports.html?ver=13

Yes, from memory port 2500 to low 3000 for data movement. 

However the error dueing the failed backup specifies 192.168.xx.xx:2500 unreachable when I'm on the isolated subnet. 

So there is a network issue of some sort maybe routing?  I am not a network expert but it is something there.

It's network related in some capacity I agree. But a strange one. 

SSH, pings managed server and hard repo all work. Only backups don't. 

Hoping a network expert comes across this post with an idea. 

Hi ​@RP-NKM focusing on quoted parts can I ask you what happens if you try a rescan for this repo? 

Consider range ports from 2500 to 3000 are used only when backup starts, this means you cannot test if backup are not running. 
Another bit to know is related to Veeam proxy. Is VBR the only proxy? Your backup job use VBR as a single proxy or you have other proxies that haven’t 2 nic? 

please share more info about your environment too. 

Thanks 

Hello, on which network interface did you configure the gateway? If the isolated network has only an IP address and subnet, add a static route for the gateway of the isolated subnet. Also, verify that the firewalls are not blocking port 2500. Let me know.

Re-scanning the repo is fine. Success. 

I was digging into a possible port obstruction when I decided to move the hard server from the isolated subnet onto the main subnet. As it worked there (without any changes to the B&R server or the hard server except an IP address change, I came to the conclusion that it really couldn’t be firewall related.

Veeam is the only proxy. 

All computers and VM’s to be backed up sit on subnet 1 with a DHCP server. 
All backup repos (NAS, hard server) sit on subnet 2 without DHCP server. 
Veeam B&R server has 2 NIC’s connected to each subnet.

I’m not a networking expert but I believe that’s a single proxy. The NAS works perfectly in this configuration. 

So then it seems to be a routing issue from the VBR acting as the Proxy to repo when in subnet 2.  I think that needs to get sorted out in order to get things working.

The gateway is configured only on my DHCP subnet that is main computer traffic. No gateway is set on the isolated backup subnet. 

UFW is turned off on the hard server at the moment. From the veeam B&R server, I can successfully perform a Test-NetConnection on port 6162 but cannot reach it on 2500 as I don’t believe it’s listening on that port currently.

Once again, simply putting this hard server into another subnet works without modifying any other settings. 

Is the VBR server Windows or VSA?  If Windows check the firewall there as well and maybe disable it to test.  Something somewhere along the path is blocking you.

Any suggestions on where to start looking? Running Windows Server 2025 on the Veeam Host and also the Veeam B&R VM. 

Or do I just leave the hard repo in the subnet it’s working in? Opinion? 

See my previous post about checking FW on Win2025 server where B&R is.

Try adding a static route on the vbr and proxy servers of the isolated network route ADD YOURSUBNETISOLATED MASK 255.255.255.0 YOURGATEWAY ISOLATED

CMD

route ADD -p 192.168.1.0 MASK 255.255.255.0 192.168.0.253

PS

PS C:\>New-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1
PS C:\> Get-NetRoute | Format-List -Property *

I also recommend adding the direct resolution of the hardened repo to the vbr server in the C:\Windows\System32\drivers\etc\hosts file.

regards