Proxmox Backup to NAS: NFS vs SMB Setup and Restore Checklist

Preparation date: September 17, 2026. Scope: This is a documentation-based implementation and verification guide, not a claim about a completed customer incident. It covers ordinary Proxmox VE VZDump backups written to NAS storage. A Proxmox Backup Server datastore is a different architecture and is called out separately. The short answer is: choose NFS when Proxmox is the main consumer and your NAS can restrict the export to the Proxmox node addresses. Choose SMB/CIFS when the same share must also fit a Windows-oriented operating model or your NAS administration is already built around named users and SMB permissions. The protocol choice matters, but the restore test matters more. A green backup task proves that an archive was written; it does not prove that you can recover a VM on replacement storage. Proxmox backup to NAS verification flow A Proxmox node writes a VZDump backup over NFS or SMB to a NAS, then a separate restore test validates recovery. ...
Post a Comment

Horizon USB Across Subnets: Identify the Transport Before Changing Firewall Rules

Documentation-based investigation guide. Revised September 12, 2026. No packet capture or completed incident record is available for this article. The earlier unsupported failure percentage and blanket TCP/UDP rule recommendation have been removed.

A USB device that works on one subnet but not another gives you a comparison opportunity—not a proven firewall diagnosis. This guide explains how to choose the traffic path to investigate. The separate subnet worksheet is for recording the results; it does not establish a root cause.

First distinguish the feature from the symptom

Record whether the device is absent from the client's redirection menu, listed but unable to connect, visible inside Windows but unusable by an application, or disconnected during use. These are different failure stages. Also distinguish generic USB redirection from optimized audio/video, printing, and client drive redirection. A working microphone through an optimized channel does not demonstrate that generic USB transport works.

Choose the right source and destination

Omnissa's port reference lists TCP 32111 for the relevant Client-to-Agent USB path, not a universal TCP/UDP rule to the Connection Server. External and tunneled connections follow different paths. Blast can also carry USB side-channel traffic when configured accordingly. Select the diagram matching the actual deployment before testing or requesting a rule.

  1. Identify the Client and Agent builds, selected display protocol, USB component, and applied USB policies.
  2. Draw the actual route: endpoint, gateway if used, and assigned desktop. Record which node was selected in each test.
  3. Ask the network owner to identify the applicable listener and transport from that topology, including any side-channel configuration.
  4. Compare connection attempts and policy decisions for the same user, endpoint, device, and desktop from both locations.

Interpret tests without overclaiming

  • A successful TCP probe: demonstrates connection establishment to that listener at that moment. It does not test USB authorization, device enumeration, or application compatibility.
  • A failed TCP probe: may reflect an incorrect destination, absent listener, routing, or filtering. Obtain listener and firewall evidence before naming the cause.
  • The device works after moving subnets: check whether gateway selection or effective policy changed too. Otherwise the experiment changed more than the network.

A safe change and a useful closure record

If logs show a blocked required flow, request a time-limited rule for its exact source, destination, transport, and port. Preserve the original rule and owner approval. Do not disable endpoint protection or allow all USB devices to make the test pass. Disconnecting a redirected storage device can interrupt writes; close applications and use the appropriate safe-removal workflow before reconnecting.

Close only after the intended device works repeatedly, forbidden device classes remain blocked, and the temporary test configuration has been removed or formally approved. Record the failed stage, evidence, precise change, retest result, and rollback. If there is no reproducible difference, leave the cause unresolved instead of converting a guess into a permanent exception.

References

Related troubleshooting guides

Comments

Post a Comment

Popular posts from this blog

Horizon vdpConnect_Failure: Connection-Stage Triage Before Reinstalling

vdpConnect_Failure is a starting symptom, not a root-cause diagnosis. Before reinstalling Horizon Agent or opening firewall ports, establish whether the failure occurs during authentication, desktop launch, or an established session. This documentation-based triage guide does not report a reproduced incident or a universal fix. Corrected September 12, 2026: The earlier guide suggested restarting the Windows RPC service and treated a local netstat listing as a test for blocked ports. Those instructions have been removed. A socket listing does not demonstrate end-to-end reachability. Classify the failure before making changes Observation First evidence to collect Avoid assuming Authentication never completes Exact login error, identity provider or broker event, timestamp That the display protocol is the failing component. Desktop selection succeeds, launch fails Assigned desktop, chosen protocol, Client/Agent and gateway logs That a successful HTTPS login proves the session path ...
Read more

Horizon Agent Unreachable: Registration and Desktop-Health Triage

Start an “Agent Unreachable” investigation by separating desktop health, Agent registration, and session traffic. Do not begin with a pool rebuild. This documentation-based triage guide helps decide which team should act and what evidence to preserve. Correction, September 12, 2026: The earlier guide mixed display ports with Agent communication, tested Blast against the Connection Server, and offered generic service restarts and image rebuilds. Those instructions have been replaced with path-specific investigation. First-response decision table Check Evidence Investigation owner Is the guest responsive? Approved console access, OS health, resource and disk observations Desktop/virtualization team if the OS is unavailable. Is this one desktop or a whole image family? Affected pool, image revision, Agent version, start time Image owner if failures align with a deployment. Does registration fail? Agent and Connection Server events for the same desktop and time Horizon team, then netw...
Read more

Horizon Protocol Error: Trace the Display-Session Handoff

A desktop can authenticate successfully and still fail to establish its display session. This guide investigates that handoff. Use it after identifying the actual console/client error, not as a claim that every “Protocol Error” means a firewall failure. Correction, September 12, 2026: The previous version combined a general checklist with an unverified incident narrative, conflated gateway and desktop port directions, and recommended blanket endpoint-security exclusions. Those instructions have been removed. This is a documentation-based diagnostic plan. Draw the attempted connection Record the selected protocol, assigned desktop, Client and Agent versions, gateway route, and attempt time. Distinguish a direct internal connection from an external UAG connection or a Connection Server tunnel. Use Omnissa's connection guide to identify where the failed handoff occurs. Stage Question Useful comparison Authentication Did the user receive desktop entitlement? Failed login versus ...
Read more