Learn Veeam - Network & Ports

#Introduction

After the hardening in episode 13, we get into the most operational detail: networking. Veeam is a distributed system — servers, proxies, repos, hypervisors, and the console talk to each other over various ports. Opening the wrong firewall means failed backups; being too open means a door for attackers. In episode 14 we map out the important ports and their security rules.

The correct approach is allow-list, not deny-list. Only the ports that are needed are opened, and only between hosts that must actually communicate.

#Veeam's Important Ports

#9392: Backup Communication (Customizable)

Port 9392 (TCP) is the default for communication between VBR server ↔ proxy ↔ repository and agents. This number always shows up in documentation and troubleshooting. The key point: it can be customized in Settings → Network. If your network uses this port for something else, or you need isolation, change it to another value — then make sure it's consistent across all components.

Check the backup communication port

Get-VBRServer | Select-Object Name,Port | Format-Table -AutoSize

#443/902: Hypervisors

443 (HTTPS) — API connections to vCenter, Proxmox VE, Nutanix Prism, and cloud endpoints.
902 (ESXi) — hot-add/NBD proxy communication with ESXi hosts.

If a proxy uses HotAdd/NBD to ESXi, make sure 902 is open from the proxy to the host; if using SAN transport, it isn't needed (goes over the storage network).

#445: SMB Repository

SMB shares (repository or NAS) use 445 (TCP) from VBR/proxy to the file server. A note from episode 6: SMB is generally more vulnerable to ransomware — minimize its use for backup targets that should be immutable.

#Other Ports That Often Appear

137/138/139 — legacy NetBIOS (avoid if possible).
SSH (22) — for Linux repositories and agents (customizable).
SQL (1433) — if VBR uses a remote SQL instance (episode 3).
Veeam ONE / web console — see episode 20 for specific ports.

Note

The list above is a subset — the complete port list (including Enterprise Manager, Veeam Agent, cloud, tape) is available at helpcenter.veeam.com → System Requirements → Used Ports. Always open only the ports your topology actually uses.

#Firewall & Segmentation

#Allow-List Rules

Create explicit firewall rules between segments:

Example port matrix

VBR Server ──▶ vCenter        : 443
VBR Server ──▶ Proxmox node   : 443
Proxy      ──▶ ESXi           : 902
Proxy      ──▶ Repository     : 9392 (or custom)
VBR/Proxy  ──▶ SMB repo       : 445
Console    ──▶ VBR Server     : 135 / dynamic

Apply them in Windows Defender Firewall (for Windows servers) and the network firewall (for segments).

#Network Segmentation

Don't put all Veeam components in one production VLAN. The recommended design:

Backup management segment — VBR, proxy control, repo management.
Backup storage segment — repo access (Linux/object) isolated from the production LAN.
Production segment — hypervisors and workloads (only needed ports cross over).

This separation slows ransomware lateral movement: even if production is infected, the path to the immutable repo is cut off.

#Access Security

#Don't Expose Veeam to the Internet

The golden rule: Veeam (console, server, repo) must never have a public IP. All components are internal. If remote administration is needed:

Use VPN (WireGuard/OpenVPN/IPsec) as an encrypted gateway.
Use a jump host / bastion with MFA.
Restrict the source IPs allowed to connect.

#Multi-Factor Authentication for the Console

Enable MFA for accounts that access the VBR console and Enterprise Manager. Stolen credentials without a second factor are useless to attackers. Veeam supports authenticator apps and smart cards.

Secure access hierarchy

Internet ──X── Veeam (blocked!)
Admin ──▶ VPN ──▶ Jump host (MFA) ──▶ VBR Console (MFA)

Warning

Exposing the VBR console to the internet "just for occasional access" is one of the fastest ways to destroy your backup infrastructure — attackers scan ports, try credentials, and exploit weak accounts. If there is one rule to remember from this episode: Veeam = internal-only + VPN.

#Verification

After this episode, make sure:

Ports 9392/custom, 443, 902, 445 are open only between the hosts that need them.
The firewall matrix is documented and applied.
VBR/proxy/repo have no public IP addresses.
VPN is active for remote access; the console uses MFA.

#Closing

Key takeaways:

9392 (customizable) for backup communication; 443 vCenter/Proxmox; 902 ESXi; 445 SMB.
Open only the ports your topology uses — allow-list, not deny-list.
Segmentation: backup management, backup storage, and production are separated.
Never expose Veeam to the internet — use VPN and a jump host.
MFA for the console and Enterprise Manager is mandatory.

In the next episode, episode 15, we will cover encryption & key management — AES-256 per-job backup encryption for ransomware and compliance, managing backup encryption keys, and audit in the form of logs, reports, and cyber event response. Your data will be locked up safely!