4 \section*{Dealing with Firewalls}
5 \label{_ChapterStart26}
6 \index[general]{Dealing with Firewalls }
7 \index[general]{Firewalls!Dealing with }
8 \addcontentsline{toc}{section}{Dealing with Firewalls}
10 If you have a firewall or a DMZ installed on your computer, you may experience
11 difficulties contacting one or more of the Clients to back them up. This is
12 especially true if you are trying to backup a Client across the Internet.
14 \subsection*{Technical Details}
15 \index[general]{Technical Details }
16 \index[general]{Details!Technical }
17 \addcontentsline{toc}{subsection}{Technical Details}
19 If you are attempting to do this, the sequence of network events in Bacula to
20 do a backup are the following:
31 Where hopefully it is obvious that DIR represents the Director, FD the File
32 daemon or client, and SD the Storage daemon. The numbers that follow those
33 names are the standard ports used by Bacula, and the -\gt{} represents the
34 left side making a connection to the right side (i.e. the right side is the
35 "server" or is listening on the specified port), and the left side is the
36 "client" that initiates the conversation.
38 Note, port 9103 serves both the Director and the File daemon, each having its
39 own independent connection.
41 If you are running {\bf iptables}, you might add something like:
45 -A FW-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9101:9103 -j ACCEPT
53 -A FW-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9102 -j ACCEPT
57 on your client. In both cases, I assume that the machine is allowed to
58 initiate connections on any port. If not, you will need to allow outgoing
59 connections on ports 9102 and 9103 on your server and 9103 on your client.
60 Thanks to Raymond Norton for this tip.
62 \subsection*{A Concrete Example}
63 \index[general]{Example!Concrete }
64 \index[general]{Concrete Example }
65 \addcontentsline{toc}{subsection}{Concrete Example}
67 The following discussion was originally written by
68 Jesse Guardiani because he has 'internal' and 'external' requiring the
69 Director and the Client to use different IP addresses. His original
70 solution was to define two different Storage resources in the Director's
71 conf file each pointing to the same Storage daemon but with different
72 IP addresses. In Bacula 1.38.x this no longer works, because Bacula makes
73 a 1 to 1 association between a Storage daemon resource and a Device (such
74 as an Autochanger). As a consequence, I have modified his original
75 text to a method that I believe will work, but is as of yet untested
78 My bacula server is on the 192.168.1.0/24 network at IP address 192.168.1.52.
79 For the sake of discussion we will refer to this network as the 'internal'
80 network because it connects to the internet through a NAT'd firewall. We will
81 call the network on the public (internet) side of the NAT'd firewall the
82 'external' network. Also, for the sake of discussion we will call my bacula
87 server.int.mydomain.tld
91 when a fully qualified domain name is required, or simply:
99 if a hostname is adequate. We will call the various bacula daemons running on
100 the server.int.mydomain.tld machine:
110 In addition, I have two clients that I want to back up with Bacula. The first
111 client is on the internal network. Its fully qualified domain name is:
115 private1.int.mydomain.tld
127 This machine is a client and therefore runs just one bacula daemon:
135 The second client is on the external network. Its fully qualified domain name
152 This machine also runs just one bacula daemon:
160 Finally, I have a NAT firewall/gateway with two network interfaces. The first
161 interface is on the internal network and serves as a gateway to the internet
162 for all the machines attached to the internal network (For example,
163 server.int.mydomain.tld and private1.int.mydomain.tld). The second interface
164 is on the external (internet) network. The external interface has been
169 firewall.mydomain.tld
177 *.int.mydomain.tld = internal network
178 *.mydomain.tld = external network
182 \subsubsection*{The Bacula Configuration Files for the Above}
183 \index[general]{Above!Bacula Configuration Files for the }
184 \index[general]{Bacula Configuration Files for the Above }
185 \addcontentsline{toc}{subsubsection}{Bacula Configuration Files for the Above}
187 server-sd manages a 4 tape AIT autoloader. All of my backups are written to
188 server-sd. I have just *one* Device resource in my server-sd.conf file:
193 Name = "autochanger1";\
195 Changer Device = /dev/ch0;
196 Changer Command = "/usr/local/sbin/chio-bacula %c %o %S %a";
202 Archive Device = /dev/nrsa1;
205 AutomaticMount = yes; # when device opened, read it
207 Hardware End of Medium = No
208 Fast Forward Space File = No
215 \ilink{the Tape Testing}{FreeBSDTapes} chapter of this manual
216 for important FreeBSD information.) However, unlike previously, there
217 is only one Storage definition in my server-dir.conf file:
222 Name = "autochanger1" # Storage device for backing up
223 Address = Storage-server
225 Password = "mysecretpassword"
226 Device = "autochanger1"
233 Note that the Storage resource uses neither of the two addresses to
234 the Storage daemon -- neither server.int.mydomain.tld nor
235 firewall.mydomain.tld, but instead uses the address Storage-server.
237 What is key is that in the internal net, Storage-server is resolved
238 to server.int.mydomain.tld, either with an entry in /etc/hosts, or by
239 creating and appropriate DNS entry, and on the external net (the Client
240 machine), Storage-server is resolved to firewall.mydomain.tld.
243 In addition to the above, I have two Client resources defined in
250 Address = private1.int.mydomain.tld
253 Password = "mysecretpassword" # password for FileDaemon
257 Address = public1.mydomain.tld
260 Password = "mysecretpassword" # password for FileDaemon
265 And finally, to tie it all together, I have two Job resources defined in
271 Name = "Private1-Backup"
275 Schedule = "WeeklyCycle"
276 Storage = "autochanger1-int"
279 Write Bootstrap = "/var/db/bacula/Private1-Backup.bsr"
283 Name = "Public1-Backup"
287 Schedule = "WeeklyCycle"
288 Storage = "autochanger1-ext"
291 Write Bootstrap = "/var/db/bacula/Public1-Backup.bsr"
297 It is important to notice that because the 'Private1-Backup' Job is intended
298 to back up a machine on the internal network so it resolves Storage-server
299 to contact the Storage daemon via the internal net.
300 On the other hand, the 'Public1-Backup' Job is intended to
301 back up a machine on the external network, so it resolves Storage-server
302 to contact the Storage daemon via the external net.
304 I have left the Pool, Catalog, Messages, FileSet, Schedule, and Director
305 resources out of the above server-dir.conf examples because they are not
306 pertinent to the discussion.
308 \subsubsection*{How Does It Work?}
309 \index[general]{How Does It Work? }
310 \index[general]{Work!How Does It }
311 \addcontentsline{toc}{subsubsection}{How Does It Work?}
313 If I want to run a backup of private1.int.mydomain.tld and store that backup
314 using server-sd then my understanding of the order of events is this:
317 \item I execute my Bacula 'console' command on server.int.mydomain.tld.
318 \item console connects to server-dir.
319 \item I tell console to 'run' backup Job 'Private1-Backup'.
320 \item console relays this command to server-dir.
321 \item server-dir connects to private1-fd at private1.int.mydomain.tld:9102
322 \item server-dir tells private1-fd to start sending the files defined in the
323 'Private1-Backup' Job's FileSet resource to the Storage resource
324 'autochanger1', which we have defined in server-dir.conf as having the
325 address:port of Storage-server, which is mapped by DNS to server.int.mydomain.tld.
326 \item private1-fd connects to server.int.mydomain.tld:9103 and begins sending
330 Alternatively, if I want to run a backup of public1.mydomain.tld and store
331 that backup using server-sd then my understanding of the order of events is
335 \item I execute my Bacula 'console' command on server.int.mydomain.tld.
336 \item console connects to server-dir.
337 \item I tell console to 'run' backup Job 'Public1-Backup'.
338 \item console relays this command to server-dir.
339 \item server-dir connects, through the NAT'd firewall, to public1-fd at
340 public1.mydomain.tld:9102
341 \item server-dir tells public1-fd to start sending the files defined in the
342 'Public1-Backup' Job's FileSet resource to the Storage resource
343 'autochanger1', which we have defined in server-dir.conf as having the
344 same address:port as above of Storage-server, but which on this machine
345 is resolved to firewall.mydomain.tld:9103.
346 \item public1-fd connects to firewall.mydomain.tld:9103 and begins sending
350 \subsubsection*{Important Note}
351 \index[general]{Important Note }
352 \index[general]{Note!Important }
353 \addcontentsline{toc}{subsubsection}{Important Note}
355 In order for the above 'Public1-Backup' Job to succeed,
356 firewall.mydomain.tld:9103 MUST be forwarded using the firewall's
357 configuration software to server.int.mydomain.tld:9103. Some firewalls call
358 this 'Server Publication'. Others may call it 'Port Forwarding'.
360 \subsubsection*{Firewall Problems}
361 \index[general]{Firewall Problems}
362 \index[general]{Problems!Firewalls}
363 \addcontentsline{toc}{subsubsection}{Firewall Problems}
364 Either a firewall or a router may decide to timeout and terminate
365 open connections if they are not active for a short time. By Internet
366 standards the period should be two hours, and should be indefinitely
367 extended if KEEPALIVE is set as is the case by Bacula. If your firewall
368 or router does not respect these rules, you may find Bacula connections
369 terminated. In that case, the first thing to try is turning on the
370 {\bf Heart Beat Interval} both in the File daemon and the Storage daemon
371 and set an interval of say five minutes.
373 Also, if you have denial of service rate limiting in your firewall, this
374 too can cause Bacula disconnects since Bacula can at times use very high
375 access rates. To avoid this, you should implement default accept
376 rules for the Bacula ports involved before the rate limiting rules.
378 Finally, if you have a Windows machine, it will most likely by default
379 disallow connections to the Bacula Windows File daemon. See the
380 Windows chapter of this manual for additional details.