I have a fairly simple site, where I have vCenter, 2 ESXi’s, a baremetal veeam backup server and 2 QNAPs for backups storage, also 2 proxies each residing on one of the ESXi (for hot-add).
Up until now, when proxies were windows ones and we didn’t use the hardened setup we had the QNAPs attached via iscsi to the proxies, where the proxies would be 1:1 nated via a linux firewall, so they would have a production reachable IP but then translated into non-production network, with different vlans and the traffic would be heavily filtered - this worked very well.
I’m redesigning this and moving the repos to linux hardened repositories now, also want to switch over the proxies to run on linux.
Is there a way, to keep the repos unreachable for the backup server itself? So the repos would be reachable only by the proxies? I imagine proxies having 2 nics, one towards the backup server and the other in the backup storage network. The backup server needs to be within the domain, and as you know this always puts some risks into the setup and the previous design kept things apart (proxies were not domain joined).
I have one proxy and one repo on linux now, for tests and I get mixed results, but I have that linux router/firewall in between still and I see the backup server is trying to reach the repos.
I’ve gone trough a lot of documentation and so on, but without a major success (I mean, things are working, but not the way I would like them to), so I assume I just missed some stuff, or maybe this is not possible the way I think about it.
Any help would be greatly appreciated!
