Veeam and Network Segmentation: Firewall Rules for Every Component

Veeam and Network Segmentation: Firewall Rules for Every Component

Veeam v13 Series | Component: All Infrastructure | Audience: Network Engineers, Infrastructure Architects, Security Teams

1. Why This Article Exists

Veeam's official port documentation is spread across a dozen pages in the help center, organized by product guide rather than by network flow. If you are a network engineer building firewall rules for a segmented Veeam deployment, you have to cross-reference the vSphere user guide, the Hyper-V user guide, the Cloud Connect guide, the Agent Management guide, and the Enterprise Manager guide to build a complete rule set. Most people get this wrong the first time because they miss one flow and backups fail silently until someone notices.

This article consolidates every component-to-component port requirement into a single reference. All port numbers are confirmed against the Veeam v13 help center documentation. VBR automatically creates Windows Firewall rules on Windows machines. On Linux machines and third-party firewalls, you must create these rules manually.

2. Backup Server (Core Ports)

The backup server is the hub. Every other component communicates with it. These ports must be open from/to the VBR server for core operations.

3. Backup Proxy (VMware, Hyper-V, General Purpose)

For VMware hot-add transport mode, the proxy must be a VM on the same ESXi host or cluster as the VMs being backed up. No additional network ports are required for hot-add because data flows through the virtual disk attach mechanism, not the network. For SAN transport mode (direct storage access), the proxy needs FC or iSCSI connectivity to the storage array, which is a storage network requirement, not a firewall rule.

4. Backup Repository (Windows, Linux, Hardened)

For hardened repositories, SSH (port 22) is only required during initial managed server setup and component upgrades. After setup, disable SSH. All ongoing communication uses the Veeam Transport Service on port 6162 and data channels on 2500-3300 using certificate-based authentication.

5. Mount Server

The vPower NFS ports (6161, 111, 1058+, 2049+) are only needed if you use Instant VM Recovery, SureBackup, or On-Demand Sandbox. These features mount backup data as an NFS datastore on the ESXi host. If you do not use these features, the vPower NFS ports can remain closed.

6. VMware vSphere Infrastructure

7. Guest Interaction (Application-Aware Processing, FLR)

Application-aware processing is what makes Veeam's SQL, Oracle, AD, and Exchange backups transactionally consistent. If these ports are blocked, AAP will fail and you get crash-consistent backups only. The "RPC function call failed" error during guest processing is almost always a firewall issue on the guest or between the proxy and the guest network.

8. Veeam ONE

9. Cloud Connect Gateway

Port 6180 is the only port that needs to be exposed to the public internet for Cloud Connect. All tenant traffic flows through this single port. It carries both control plane and data plane traffic, encrypted with TLS. Do not expose any other VBR port to the internet.

10. Enterprise Manager

11. Agent Management

12. Plug-in Workloads (AHV, Proxmox)

13. Putting It Together: A Segmented Network Design

Here is a reference design for a segmented Veeam deployment with four network zones.

Zone 1: Management Network

Contains the VBR server, Veeam ONE server, Enterprise Manager, and admin workstations. Firewall allows outbound to all other zones on the specific ports listed above. No inbound from the backup data network except for REST API polling (if Veeam ONE is on the management network and VBR is elsewhere).

Zone 2: Production / Hypervisor Network

Contains vCenter, ESXi hosts, Hyper-V hosts, and VM guest networks. Firewall allows inbound from management network (VBR to vCenter on 443, VBR to ESXi on 443/902) and inbound from the proxy network (proxy to ESXi on 443/902). Guest processing requires inbound from proxy/VBR to guest VMs on the guest interaction ports.

Zone 3: Backup Data Network

Contains backup proxies and backup repositories. This is the high-bandwidth zone where actual backup data flows. Firewall allows inbound from production network (proxy reads from hypervisor) and outbound to repository on 2500-3300. The management network reaches this zone on 6160, 6162, and 2500-3300. Object storage offload goes from repository to the internet on 443.

Zone 4: Isolated Recovery / Cloud Connect

Contains the Cloud Connect gateway, SureBackup lab, and instant recovery staging. The gateway exposes port 6180 to the internet (or to tenant networks). Internally, it communicates with the SP VBR server and repository on the standard ports. SureBackup labs should be completely isolated from production with no routing to prevent accidental production impact during recovery testing.