
#include "bacula_template.inc" title="Firewall Issues"

<h1>Dealing with Firewalls</h1>
If you have a firewall or a DMZ installed on your computer, you 
may experience difficulties contacting one or more of the Clients
to back them up. This is especially true if you are trying to
backup a Client across the Internet.

<h2>Technical Details</h2>
If you are attempting to do this, the sequence of network
events in Bacula to do a backup are the following:
<pre>
Console -&gt; DIR:9101
DIR     -&gt; SD:9103
DIR     -&gt; FD:9102
FD      -&gt; SD:9103
</pre>
Where it should be obvious that DIR represents the Director,
FD the File daemon or client, and SD the Storage daemon. The
numbers that follow those names are the standard ports used
by Bacula, and the -&gt; represents the left side making
a connection to the right side (i.e. the right side is
the &quot;server&quot; or is listening on the specified
port), and the left side is the &quot;client&quot; who
initiates the conversation.
<p>Note, port 9103 serves both
the Director and the File daemon, each having its own
independent connection.
<p>
If you are running <b>iptables</b>, you might add something like:
<pre>
-A FW-1-INPUT -m state --state NEW -m tcp -p tcp --dport \
   9101:9103 -j ACCEPT
</pre>
on your server, and
<pre>
-A FW-1-INPUT -m state --state NEW -m tcp -p tcp --dport \
   9102 -j ACCEPT
</pre>
on your client. In both cases, I assume that the machine is allowed
to initiate connections on any port. If not, you will need to
allow outgoing connections on ports 9102 and 9103 on your server
and 9103 on your client.  Thanks to Raymond Norton for this tip.

<h2>A Concrete Example</h2>
Jesse Guardiani's solution for his network for this 
problem, in his own words, is:
<p>
My bacula server is on the 192.168.1.0/24 network at IP address 192.168.1.52.
For the sake of discussion we will refer to this network as the 'internal'
network because it connects to the internet through a NAT'd firewall. We
will call the network on the public (internet) side of the NAT'd firewall
the 'external' network. Also, for the sake of discussion we will call my
bacula server:
<pre>
    server.int.mydomain.tld
</pre>
when a fully qualified domain name is required, or simply:
<pre>
    server
</pre>
if a hostname is adequate. We will call the various bacula daemons running
on the server.int.mydomain.tld machine:
<pre>
    server-fd
    server-sd
    server-dir
</pre>

In addition, I have two clients that I want to back up with Bacula. The
first client is on the internal network. Its fully qualified domain name is:
<pre>
    private1.int.mydomain.tld
</pre>
And its hostname is:
<pre>
    private1
</pre>
This machine is a client and therefore runs just one bacula daemon:
<pre>
    private1-fd
</pre>

The second client is on the external network. Its fully qualified domain
name is:
<pre>
    public1.mydomain.tld
</pre>
And its hostname is:
<pre>
    public1
</pre>
This machine also runs just one bacula daemon:
<pre>
    public1-fd
</pre>

Finally, I have a NAT firewall/gateway with two network interfaces.
The first interface is on the internal network and serves as a gateway to the
internet for all the machines attached to the internal network (For example,
server.int.mydomain.tld and private1.int.mydomain.tld). The second
interface is on the external (internet) network. The external interface
has been assigned the name:
<pre>
    firewall.mydomain.tld
</pre>

Remember:
<pre>
    *.int.mydomain.tld = internal network
        *.mydomain.tld = external network
</pre>


<h3>The Bacula Configuration Files for the Above</h3>

server-sd manages a 4 tape AIT autoloader. All of my backups are written to
server-sd. I have just *one* Device resource in my server-sd.conf file:
<pre>
Device {
  Name = "autochanger1";
  Media Type = AIT-1;
  Archive Device = /dev/nrsa1;
  Changer Device = /dev/ch0;
  Changer Command = "/usr/local/sbin/chio-bacula %c %o %S %a";
  Label Media = yes;
  AutoChanger = yes;
  AutomaticMount = yes;               # when device opened, read it
  AlwaysOpen = yes;
  # Due to supposed limitations in FreeBSD SCSI tape driver:
    Hardware End of Medium = No
    Fast Forward Space File = No
    BSF at EOM = yes
}
</pre>
(note, please see <a href="tapetesting.html#FreeBSDTapes">the Tape
Testing</a> chapter of this manual for important FreeBSD information.)

However, I have *two* Storage resources in my server-dir.conf file:
<pre>
Storage {
  Name = "autochanger1-int"    # Storage device for backing up 
                               # machines on the INTERNAL network.
  Address = server.int.mydomain.tld 
  SDPort = 9103
  Password = "mysecretpassword"
  Device = "autochanger1"
  Media Type = AIT-1
  Autochanger = yes
}
Storage {
  Name = "autochanger1-ext"    # Storage device for backing up 
                               # machines on the EXTERNAL network.
  Address = firewall.mydomain.tld
  SDPort = 9103
  Password = "mysecretpassword"
  Device = "autochanger1"
  Media Type = AIT-1
  Autochanger = yes
}
</pre>
Note that BOTH of the above server-dir.conf Storage resources use the same
'autochanger1' Device resource from server-sd.conf.
<p>
My backup jobs run consecutively, one after the other, so only one of the
above Storage resources is being used by Bacula file daemons at any given
time. I don't know if this would cause problems at a site that runs more
than one backup in parallel to a single tape device.
<p>
In addition to the above, I have two Client resources defined in
server-dir.conf:
<pre>
Client {
  Name = private1-fd
  Address = private1.int.mydomain.tld
  FDPort = 9102
  Catalog = MyCatalog
  Password = "mysecretpassword"       # password for FileDaemon
}
Client {
  Name = public1-fd
  Address = public1.mydomain.tld
  FDPort = 9102
  Catalog = MyCatalog
  Password = "mysecretpassword"       # password for FileDaemon
}
</pre>


And finally, to tie it all together, I have two Job resources defined in
server-dir.conf:
<pre>
Job {
  Name = "Private1-Backup"
  Type = Backup
  Client = private1-fd
  FileSet = "Private1"
  Schedule = "WeeklyCycle"
  Storage = "autochanger1-int"
  Messages = Standard
  Pool = "Weekly"
  Write Bootstrap = "/var/db/bacula/Private1-Backup.bsr"
  Priority = 12
}
Job {
  Name = "Public1-Backup"
  Type = Backup
  Client = public1-fd
  FileSet = "Public1"
  Schedule = "WeeklyCycle"
  Storage = "autochanger1-ext"
  Messages = Standard
  Pool = "Weekly"
  Write Bootstrap = "/var/db/bacula/Public1-Backup.bsr"
  Priority = 13
}
</pre>

It is important to notice that because the 'Private1-Backup' Job is intended
to back up a machine on the internal network it uses the 'autochanger1-int'
Storage resource. On the other hand, the 'Public1-Backup' Job is intended to
back up a machine on the external network, so it uses the 'autochanger1-ext'
Storage resource.
<p>
I have left the Pool, Catalog, Messages, FileSet, Schedule, and Director
resources out of the above server-dir.conf examples because they are not
pertinent to the discussion.


<h3>How Does It Work?</h3>
If I want to run a backup of private1.int.mydomain.tld and store that backup
using server-sd then my understanding of the order of events is this:
<ol>
  <li>I execute my Bacula 'console' command on server.int.mydomain.tld.</li>
  <li>console connects to server-dir.</li>
  <li>I tell console to 'run' backup Job 'Private1-Backup'.</li>
  <li>console relays this command to server-dir.</li>
  <li>server-dir connects to private1-fd at private1.int.mydomain.tld:9102</li>
  <li>server-dir tells private1-fd to start sending the files defined in
    the 'Private1-Backup' Job's FileSet resource to the Storage resource
    'autochanger1-int', which we have defined in server-dir.conf as having the
    address:port of server.int.mydomain.tld:9103.</li>
  <li>private1-fd connects to server.int.mydomain.tld:9103 and begins sending
    files.</li>
</ol>
<p>
Alternatively, if I want to run a backup of public1.mydomain.tld and store that
backup using server-sd then my understanding of the order of events is this:
<ol>
  <li>I execute my Bacula 'console' command on server.int.mydomain.tld.</li>
  <li>console connects to server-dir.</li>
  <li>I tell console to 'run' backup Job 'Public1-Backup'.</li>
  <li>console relays this command to server-dir.</li>
  <li>server-dir connects, through the NAT'd firewall, to public1-fd at
      public1.mydomain.tld:9102</li>
  <li>server-dir tells public1-fd to start sending the files defined in
    the 'Public1-Backup' Job's FileSet resource to the Storage resource
    'autochanger1-ext', which we have defined in server-dir.conf as having the
    address:port of firewall.mydomain.tld:9103.</li>
  <li>public1-fd connects to firewall.mydomain.tld:9103 and begins sending
    files.</li>
</ol>
<p>
<h3>Important Note</h3>
In order for the above 'Public1-Backup' Job to succeed,
firewall.mydomain.tld:9103 MUST be forwarded using the firewall's
configuration software to server.int.mydomain.tld:9103. Some firewalls
call this 'Server Publication'. Others may call it 'Port Forwarding'.




<page_prev name="Security Issues" url="security.html">
<page_next name="Bacula Projects" url="projects.html">
