<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<!--Converted with LaTeX2HTML 2008 (1.71)
original version by: Nikos Drakos, CBLU, University of Leeds
* revised and updated by: Marcus Hennecke, Ross Moore, Herb Swan
* with significant contributions from:
Jens Lippmann, Marek Rouchal, Martin Wilck and others -->
<HTML>
<HEAD>
<TITLE>Dealing with Firewalls</TITLE>
<META NAME="description" CONTENT="Dealing with Firewalls">
<META NAME="keywords" CONTENT="problems">
<META NAME="resource-type" CONTENT="document">
<META NAME="distribution" CONTENT="global">
<META NAME="Generator" CONTENT="LaTeX2HTML v2008">
<META HTTP-EQUIV="Content-Style-Type" CONTENT="text/css">
<LINK REL="STYLESHEET" HREF="problems.css">
<LINK REL="next" HREF="What_Do_When_Bacula.html">
<LINK REL="previous" HREF="Testing_Your_Tape_Drive.html">
<LINK REL="up" HREF="Bacula_Problem_Resolution_G.html">
<LINK REL="next" HREF="What_Do_When_Bacula.html">
</HEAD>
<BODY >
<!--Navigation Panel-->
<A NAME="tex2html352"
HREF="What_Do_When_Bacula.html">
<IMG WIDTH="37" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="next" SRC="next.png"></A>
<A NAME="tex2html346"
HREF="Bacula_Problem_Resolution_G.html">
<IMG WIDTH="26" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="up" SRC="up.png"></A>
<A NAME="tex2html340"
HREF="Testing_Your_Tape_Drive.html">
<IMG WIDTH="63" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="previous" SRC="prev.png"></A>
<A NAME="tex2html348"
HREF="Contents.html">
<IMG WIDTH="65" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="contents" SRC="contents.png"></A>
<A NAME="tex2html350"
HREF="GNU_Free_Documentation_Lice.html">
<IMG WIDTH="43" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="index" SRC="index.png"></A>
<BR>
<B> Next:</B> <A NAME="tex2html353"
HREF="What_Do_When_Bacula.html">What To Do When</A>
<B> Up:</B> <A NAME="tex2html347"
HREF="Bacula_Problem_Resolution_G.html">Bacula Problem Resolution Guide</A>
<B> Previous:</B> <A NAME="tex2html341"
HREF="Testing_Your_Tape_Drive.html">Testing Your Tape Drive</A>
<B> <A NAME="tex2html349"
HREF="Contents.html">Contents</A></B>
<B> <A NAME="tex2html351"
HREF="GNU_Free_Documentation_Lice.html">Index</A></B>
<BR>
<BR>
<!--End of Navigation Panel-->
<!--Table of Child-Links-->
<A NAME="CHILD_LINKS"><STRONG>Subsections</STRONG></A>
<UL>
<LI><A NAME="tex2html354"
HREF="Dealing_with_Firewalls.html#SECTION00510000000000000000">Technical Details</A>
<LI><A NAME="tex2html355"
HREF="Dealing_with_Firewalls.html#SECTION00520000000000000000">A Concrete Example</A>
<UL>
<LI><A NAME="tex2html356"
HREF="Dealing_with_Firewalls.html#SECTION00521000000000000000">The Bacula Configuration Files for the Above</A>
<LI><A NAME="tex2html357"
HREF="Dealing_with_Firewalls.html#SECTION00522000000000000000">How Does It Work?</A>
<LI><A NAME="tex2html358"
HREF="Dealing_with_Firewalls.html#SECTION00523000000000000000">Important Note</A>
<LI><A NAME="tex2html359"
HREF="Dealing_with_Firewalls.html#SECTION00524000000000000000">Firewall Problems</A>
</UL></UL>
<!--End of Table of Child-Links-->
<HR>
<H1><A NAME="SECTION00500000000000000000"></A>
<A NAME="FirewallsChapter"></A>
<BR>
Dealing with Firewalls
</H1>
<A NAME="2797"></A>
<A NAME="2798"></A>
<P>
If you have a firewall or a DMZ installed on your computer, you may experience
difficulties contacting one or more of the Clients to back them up. This is
especially true if you are trying to backup a Client across the Internet.
<P>
<H1><A NAME="SECTION00510000000000000000">
Technical Details</A>
</H1>
<A NAME="2800"></A>
<A NAME="2801"></A>
<P>
If you are attempting to do this, the sequence of network events in Bacula to
do a backup are the following:
<P>
<PRE>
Console -> DIR:9101
DIR -> SD:9103
DIR -> FD:9102
FD -> SD:9103
</PRE>
<P>
Where hopefully it is obvious that DIR represents the Director, FD the File
daemon or client, and SD the Storage daemon. The numbers that follow those
names are the standard ports used by Bacula, and the <code>-></code> represents the
left side making a connection to the right side (i.e. the right side is the
"server" or is listening on the specified port), and the left side is the
"client" that initiates the conversation.
<P>
Note, port 9103 serves both the Director and the File daemon, each having its
own independent connection.
<P>
If you are running <B>iptables</B>, you might add something like:
<P>
<PRE>
-A FW-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9101:9103 -j ACCEPT
</PRE>
<P>
on your server, and
<P>
<PRE>
-A FW-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9102 -j ACCEPT
</PRE>
<P>
on your client. In both cases, I assume that the machine is allowed to
initiate connections on any port. If not, you will need to allow outgoing
connections on ports 9102 and 9103 on your server and 9103 on your client.
Thanks to Raymond Norton for this tip.
<P>
<H1><A NAME="SECTION00520000000000000000">
A Concrete Example</A>
</H1>
<A NAME="2810"></A>
<A NAME="2811"></A>
<P>
The following discussion was originally written by
Jesse Guardiani because he has 'internal' and 'external' requiring the
Director and the Client to use different IP addresses. His original
solution was to define two different Storage resources in the Director's
conf file each pointing to the same Storage daemon but with different
IP addresses. In Bacula 1.38.x this no longer works, because Bacula makes
a one-to-one association between a Storage daemon resource and a Device (such
as an Autochanger). As a consequence, I have modified his original
text to a method that I believe will work, but is as of yet untested
(KES - July 2006).
<P>
My bacula server is on the 192.168.1.0/24 network at IP address 192.168.1.52.
For the sake of discussion we will refer to this network as the 'internal'
network because it connects to the internet through a NAT'd firewall. We will
call the network on the public (internet) side of the NAT'd firewall the
'external' network. Also, for the sake of discussion we will call my bacula
server:
<P>
<PRE>
server.int.mydomain.tld
</PRE>
<P>
when a fully qualified domain name is required, or simply:
<P>
<PRE>
server
</PRE>
<P>
if a hostname is adequate. We will call the various bacula daemons running on
the server.int.mydomain.tld machine:
<P>
<PRE>
server-fd
server-sd
server-dir
</PRE>
<P>
In addition, I have two clients that I want to back up with Bacula. The first
client is on the internal network. Its fully qualified domain name is:
<P>
<PRE>
private1.int.mydomain.tld
</PRE>
<P>
And its hostname is:
<P>
<PRE>
private1
</PRE>
<P>
This machine is a client and therefore runs just one bacula daemon:
<P>
<PRE>
private1-fd
</PRE>
<P>
The second client is on the external network. Its fully qualified domain name
is:
<P>
<PRE>
public1.mydomain.tld
</PRE>
<P>
And its hostname is:
<P>
<PRE>
public1
</PRE>
<P>
This machine also runs just one bacula daemon:
<P>
<PRE>
public1-fd
</PRE>
<P>
Finally, I have a NAT firewall/gateway with two network interfaces. The first
interface is on the internal network and serves as a gateway to the internet
for all the machines attached to the internal network (For example,
server.int.mydomain.tld and private1.int.mydomain.tld). The second interface
is on the external (internet) network. The external interface has been
assigned the name:
<P>
<PRE>
firewall.mydomain.tld
</PRE>
<P>
Remember:
<P>
<PRE>
*.int.mydomain.tld = internal network
*.mydomain.tld = external network
</PRE>
<P>
<H2><A NAME="SECTION00521000000000000000">
The Bacula Configuration Files for the Above</A>
</H2>
<A NAME="2835"></A>
<A NAME="2836"></A>
<P>
server-sd manages a 4 tape AIT autoloader. All of my backups are written to
server-sd. I have just *one* Device resource in my server-sd.conf file:
<P>
<PRE>
Autochanger {
Name = "autochanger1";\
Device = Drive0
Changer Device = /dev/ch0;
Changer Command = "/usr/local/sbin/chio-bacula %c %o %S %a";
}
Device {
Name = Drive0
DriveIndex = 0
Media Type = AIT-1;
Archive Device = /dev/nrsa1;
Label Media = yes;
AutoChanger = yes;
AutomaticMount = yes; # when device opened, read it
AlwaysOpen = yes;
Hardware End of Medium = No
Fast Forward Space File = No
BSF at EOM = yes
}
</PRE>
<P>
(note, please see
the Tape TestingFreeBSDTapes chapter of this manual
for important FreeBSD information.) However, unlike previously, there
is only one Storage definition in my server-dir.conf file:
<P>
<PRE>
Storage {
Name = "autochanger1" # Storage device for backing up
Address = Storage-server
SDPort = 9103
Password = "mysecretpassword"
Device = "autochanger1"
Media Type = AIT-1
Autochanger = yes
}
</PRE>
<P>
Note that the Storage resource uses neither of the two addresses to
the Storage daemon - neither server.int.mydomain.tld nor
firewall.mydomain.tld, but instead uses the address Storage-server.
<P>
What is key is that in the internal net, Storage-server is resolved
to server.int.mydomain.tld, either with an entry in /etc/hosts, or by
creating and appropriate DNS entry, and on the external net (the Client
machine), Storage-server is resolved to firewall.mydomain.tld.
<P>
In addition to the above, I have two Client resources defined in
server-dir.conf:
<P>
<PRE>
Client {
Name = private1-fd
Address = private1.int.mydomain.tld
FDPort = 9102
Catalog = MyCatalog
Password = "mysecretpassword" # password for FileDaemon
}
Client {
Name = public1-fd
Address = public1.mydomain.tld
FDPort = 9102
Catalog = MyCatalog
Password = "mysecretpassword" # password for FileDaemon
}
</PRE>
<P>
And finally, to tie it all together, I have two Job resources defined in
server-dir.conf:
<P>
<PRE>
Job {
Name = "Private1-Backup"
Type = Backup
Client = private1-fd
FileSet = "Private1"
Schedule = "WeeklyCycle"
Storage = "autochanger1-int"
Messages = Standard
Pool = "Weekly"
Write Bootstrap = "/var/db/bacula/Private1-Backup.bsr"
Priority = 12
}
Job {
Name = "Public1-Backup"
Type = Backup
Client = public1-fd
FileSet = "Public1"
Schedule = "WeeklyCycle"
Storage = "autochanger1-ext"
Messages = Standard
Pool = "Weekly"
Write Bootstrap = "/var/db/bacula/Public1-Backup.bsr"
Priority = 13
}
</PRE>
<P>
It is important to notice that because the 'Private1-Backup' Job is intended
to back up a machine on the internal network so it resolves Storage-server
to contact the Storage daemon via the internal net.
On the other hand, the 'Public1-Backup' Job is intended to
back up a machine on the external network, so it resolves Storage-server
to contact the Storage daemon via the external net.
<P>
I have left the Pool, Catalog, Messages, FileSet, Schedule, and Director
resources out of the above server-dir.conf examples because they are not
pertinent to the discussion.
<P>
<H2><A NAME="SECTION00522000000000000000">
How Does It Work?</A>
</H2>
<A NAME="2848"></A>
<A NAME="2849"></A>
<P>
If I want to run a backup of private1.int.mydomain.tld and store that backup
using server-sd then my understanding of the order of events is this:
<P>
<OL>
<LI>I execute my Bacula 'console' command on server.int.mydomain.tld.
</LI>
<LI>console connects to server-dir.
</LI>
<LI>I tell console to 'run' backup Job 'Private1-Backup'.
</LI>
<LI>console relays this command to server-dir.
</LI>
<LI>server-dir connects to private1-fd at private1.int.mydomain.tld:9102
</LI>
<LI>server-dir tells private1-fd to start sending the files defined in the
'Private1-Backup' Job's FileSet resource to the Storage resource
'autochanger1', which we have defined in server-dir.conf as having the
address:port of Storage-server, which is mapped by DNS to server.int.mydomain.tld.
</LI>
<LI>private1-fd connects to server.int.mydomain.tld:9103 and begins sending
files.
</LI>
</OL>
<P>
Alternatively, if I want to run a backup of public1.mydomain.tld and store
that backup using server-sd then my understanding of the order of events is
this:
<P>
<OL>
<LI>I execute my Bacula 'console' command on server.int.mydomain.tld.
</LI>
<LI>console connects to server-dir.
</LI>
<LI>I tell console to 'run' backup Job 'Public1-Backup'.
</LI>
<LI>console relays this command to server-dir.
</LI>
<LI>server-dir connects, through the NAT'd firewall, to public1-fd at
public1.mydomain.tld:9102
</LI>
<LI>server-dir tells public1-fd to start sending the files defined in the
'Public1-Backup' Job's FileSet resource to the Storage resource
'autochanger1', which we have defined in server-dir.conf as having the
same address:port as above of Storage-server, but which on this machine
is resolved to firewall.mydomain.tld:9103.
</LI>
<LI>public1-fd connects to firewall.mydomain.tld:9103 and begins sending
files.
</LI>
</OL>
<P>
<H2><A NAME="SECTION00523000000000000000">
Important Note</A>
</H2>
<A NAME="2855"></A>
<A NAME="2856"></A>
<P>
In order for the above 'Public1-Backup' Job to succeed,
firewall.mydomain.tld:9103 MUST be forwarded using the firewall's
configuration software to server.int.mydomain.tld:9103. Some firewalls call
this 'Server Publication'. Others may call it 'Port Forwarding'.
<P>
<H2><A NAME="SECTION00524000000000000000">
Firewall Problems</A>
</H2>
<A NAME="2858"></A>
<A NAME="2859"></A>
Either a firewall or a router may decide to timeout and terminate
open connections if they are not active for a short time. By Internet
standards the period should be two hours, and should be indefinitely
extended if KEEPALIVE is set as is the case by Bacula. If your firewall
or router does not respect these rules, you may find Bacula connections
terminated. In that case, the first thing to try is turning on the
<B>Heart Beat Interval</B> both in the File daemon and the Storage daemon
and set an interval of say five minutes.
<P>
Also, if you have denial of service rate limiting in your firewall, this
too can cause Bacula disconnects since Bacula can at times use very high
access rates. To avoid this, you should implement default accept
rules for the Bacula ports involved before the rate limiting rules.
<P>
Finally, if you have a Windows machine, it will most likely by default
disallow connections to the Bacula Windows File daemon. See the
Windows chapter of this manual for additional details.
<P>
<HR>
<!--Navigation Panel-->
<A NAME="tex2html352"
HREF="What_Do_When_Bacula.html">
<IMG WIDTH="37" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="next" SRC="next.png"></A>
<A NAME="tex2html346"
HREF="Bacula_Problem_Resolution_G.html">
<IMG WIDTH="26" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="up" SRC="up.png"></A>
<A NAME="tex2html340"
HREF="Testing_Your_Tape_Drive.html">
<IMG WIDTH="63" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="previous" SRC="prev.png"></A>
<A NAME="tex2html348"
HREF="Contents.html">
<IMG WIDTH="65" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="contents" SRC="contents.png"></A>
<A NAME="tex2html350"
HREF="GNU_Free_Documentation_Lice.html">
<IMG WIDTH="43" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="index" SRC="index.png"></A>
<BR>
<B> Next:</B> <A NAME="tex2html353"
HREF="What_Do_When_Bacula.html">What To Do When</A>
<B> Up:</B> <A NAME="tex2html347"
HREF="Bacula_Problem_Resolution_G.html">Bacula Problem Resolution Guide</A>
<B> Previous:</B> <A NAME="tex2html341"
HREF="Testing_Your_Tape_Drive.html">Testing Your Tape Drive</A>
<B> <A NAME="tex2html349"
HREF="Contents.html">Contents</A></B>
<B> <A NAME="tex2html351"
HREF="GNU_Free_Documentation_Lice.html">Index</A></B>
<!--End of Navigation Panel-->
<ADDRESS>
2012-01-24
</ADDRESS>
</BODY>
</HTML>
