4 \section*{Dealing with Firewalls}
5 \label{_ChapterStart26}
6 \index[general]{Dealing with Firewalls }
7 \index[general]{Firewalls!Dealing with }
8 \addcontentsline{toc}{section}{Dealing with Firewalls}
10 If you have a firewall or a DMZ installed on your computer, you may experience
11 difficulties contacting one or more of the Clients to back them up. This is
12 especially true if you are trying to backup a Client across the Internet.
14 \subsection*{Technical Details}
15 \index[general]{Technical Details }
16 \index[general]{Details!Technical }
17 \addcontentsline{toc}{subsection}{Technical Details}
19 If you are attempting to do this, the sequence of network events in Bacula to
20 do a backup are the following:
31 Where it should be obvious that DIR represents the Director, FD the File
32 daemon or client, and SD the Storage daemon. The numbers that follow those
33 names are the standard ports used by Bacula, and the -\gt{} represents the
34 left side making a connection to the right side (i.e. the right side is the
35 ``server'' or is listening on the specified port), and the left side is the
36 ``client'' who initiates the conversation.
38 Note, port 9103 serves both the Director and the File daemon, each having its
39 own independent connection.
41 If you are running {\bf iptables}, you might add something like:
45 -A FW-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9101:9103 -j ACCEPT
53 -A FW-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9102 -j ACCEPT
57 on your client. In both cases, I assume that the machine is allowed to
58 initiate connections on any port. If not, you will need to allow outgoing
59 connections on ports 9102 and 9103 on your server and 9103 on your client.
60 Thanks to Raymond Norton for this tip.
62 \subsection*{A Concrete Example}
63 \index[general]{Example!Concrete }
64 \index[general]{Concrete Example }
65 \addcontentsline{toc}{subsection}{Concrete Example}
67 Jesse Guardiani's solution for his network for this problem, in his own words,
70 My bacula server is on the 192.168.1.0/24 network at IP address 192.168.1.52.
71 For the sake of discussion we will refer to this network as the 'internal'
72 network because it connects to the internet through a NAT'd firewall. We will
73 call the network on the public (internet) side of the NAT'd firewall the
74 'external' network. Also, for the sake of discussion we will call my bacula
79 server.int.mydomain.tld
83 when a fully qualified domain name is required, or simply:
91 if a hostname is adequate. We will call the various bacula daemons running on
92 the server.int.mydomain.tld machine:
102 In addition, I have two clients that I want to back up with Bacula. The first
103 client is on the internal network. Its fully qualified domain name is:
107 private1.int.mydomain.tld
119 This machine is a client and therefore runs just one bacula daemon:
127 The second client is on the external network. Its fully qualified domain name
144 This machine also runs just one bacula daemon:
152 Finally, I have a NAT firewall/gateway with two network interfaces. The first
153 interface is on the internal network and serves as a gateway to the internet
154 for all the machines attached to the internal network (For example,
155 server.int.mydomain.tld and private1.int.mydomain.tld). The second interface
156 is on the external (internet) network. The external interface has been
161 firewall.mydomain.tld
169 *.int.mydomain.tld = internal network
170 *.mydomain.tld = external network
174 \subsubsection*{The Bacula Configuration Files for the Above}
175 \index[general]{Above!Bacula Configuration Files for the }
176 \index[general]{Bacula Configuration Files for the Above }
177 \addcontentsline{toc}{subsubsection}{Bacula Configuration Files for the Above}
179 server-sd manages a 4 tape AIT autoloader. All of my backups are written to
180 server-sd. I have just *one* Device resource in my server-sd.conf file:
185 Name = "autochanger1";
187 Archive Device = /dev/nrsa1;
188 Changer Device = /dev/ch0;
189 Changer Command = "/usr/local/sbin/chio-bacula %c %o %S %a";
192 AutomaticMount = yes; # when device opened, read it
194 Hardware End of Medium = No
195 Fast Forward Space File = No
202 \ilink{the Tape Testing}{FreeBSDTapes} chapter of this manual
203 for important FreeBSD information.) However, I have *two* Storage resources in
204 my server-dir.conf file:
209 Name = "autochanger1-int" # Storage device for backing up
210 Address = server.int.mydomain.tld
212 Password = "mysecretpassword"
213 Device = "autochanger1"
218 Name = "autochanger1-ext" # Storage device for backing up
219 Address = firewall.mydomain.tld
221 Password = "mysecretpassword"
222 Device = "autochanger1"
229 Note that BOTH of the above server-dir.conf Storage resources use the same
230 'autochanger1' Device resource from server-sd.conf.
232 My backup jobs run consecutively, one after the other, so only one of the
233 above Storage resources is being used by Bacula file daemons at any given
234 time. I don't know if this would cause problems at a site that runs more than
235 one backup in parallel to a single tape device.
237 In addition to the above, I have two Client resources defined in
244 Address = private1.int.mydomain.tld
247 Password = "mysecretpassword" # password for FileDaemon
251 Address = public1.mydomain.tld
254 Password = "mysecretpassword" # password for FileDaemon
259 And finally, to tie it all together, I have two Job resources defined in
265 Name = "Private1-Backup"
269 Schedule = "WeeklyCycle"
270 Storage = "autochanger1-int"
273 Write Bootstrap = "/var/db/bacula/Private1-Backup.bsr"
277 Name = "Public1-Backup"
281 Schedule = "WeeklyCycle"
282 Storage = "autochanger1-ext"
285 Write Bootstrap = "/var/db/bacula/Public1-Backup.bsr"
291 It is important to notice that because the 'Private1-Backup' Job is intended
292 to back up a machine on the internal network it uses the 'autochanger1-int'
293 Storage resource. On the other hand, the 'Public1-Backup' Job is intended to
294 back up a machine on the external network, so it uses the 'autochanger1-ext'
297 I have left the Pool, Catalog, Messages, FileSet, Schedule, and Director
298 resources out of the above server-dir.conf examples because they are not
299 pertinent to the discussion.
301 \subsubsection*{How Does It Work?}
302 \index[general]{How Does It Work? }
303 \index[general]{Work!How Does It }
304 \addcontentsline{toc}{subsubsection}{How Does It Work?}
306 If I want to run a backup of private1.int.mydomain.tld and store that backup
307 using server-sd then my understanding of the order of events is this:
310 \item I execute my Bacula 'console' command on server.int.mydomain.tld.
311 \item console connects to server-dir.
312 \item I tell console to 'run' backup Job 'Private1-Backup'.
313 \item console relays this command to server-dir.
314 \item server-dir connects to private1-fd at private1.int.mydomain.tld:9102
315 \item server-dir tells private1-fd to start sending the files defined in the
316 'Private1-Backup' Job's FileSet resource to the Storage resource
317 'autochanger1-int', which we have defined in server-dir.conf as having the
318 address:port of server.int.mydomain.tld:9103.
319 \item private1-fd connects to server.int.mydomain.tld:9103 and begins sending
323 Alternatively, if I want to run a backup of public1.mydomain.tld and store
324 that backup using server-sd then my understanding of the order of events is
328 \item I execute my Bacula 'console' command on server.int.mydomain.tld.
329 \item console connects to server-dir.
330 \item I tell console to 'run' backup Job 'Public1-Backup'.
331 \item console relays this command to server-dir.
332 \item server-dir connects, through the NAT'd firewall, to public1-fd at
333 public1.mydomain.tld:9102
334 \item server-dir tells public1-fd to start sending the files defined in the
335 'Public1-Backup' Job's FileSet resource to the Storage resource
336 'autochanger1-ext', which we have defined in server-dir.conf as having the
337 address:port of firewall.mydomain.tld:9103.
338 \item public1-fd connects to firewall.mydomain.tld:9103 and begins sending
342 \subsubsection*{Important Note}
343 \index[general]{Important Note }
344 \index[general]{Note!Important }
345 \addcontentsline{toc}{subsubsection}{Important Note}
347 In order for the above 'Public1-Backup' Job to succeed,
348 firewall.mydomain.tld:9103 MUST be forwarded using the firewall's
349 configuration software to server.int.mydomain.tld:9103. Some firewalls call
350 this 'Server Publication'. Others may call it 'Port Forwarding'.