Network topology for targeted server and client backup with separate VLANs
In any computer network, data backup is among the most critical tasks and primary concerns of network administrators. Equally important is the control and management of inbound and outbound traffic to and from the backup server, which directly affects network performance and security.
Based on my practical experience in designing network infrastructures for backup purposes, I have developed the following topology and derived several key results from its implementation.
In this topology, a MikroTik router has been utilized, with all relevant VLANs properly defined and configured. It is worth noting that the choice of router vendor does not have a significant impact on the overall functionality or outcome of this design.
The main objective of this configuration is as follows:
Traffic from VLAN 60, representing the network administration segment, is routed through Port 1 of the backup server, which operates within VLAN 140. This setup enables the network administrator to access essential management functions required for backup operations.
The backup traffic of production servers, residing in VLANs 200 and 210, is routed through Port 2 of the backup server, associated with VLAN 150.
Similarly, the backup traffic of network clients, assigned to VLAN 70, is routed through Port 3 of the backup server, which belongs to VLAN 160.
Through this approach, both server and client backups can be performed in a fully isolated Layer 2 environment, ensuring optimal data separation and security. Furthermore, by dedicating a specific VLAN accessible exclusively to the network administrator, management access — including Remote Desktop and the web interface of the backup server — can be securely configured. This design effectively prevents any form of unauthorized access to the backup server while maintaining operational efficiency and network integrity.
Get Alizare’s stories in your inbox
Join Medium for free to get updates from this writer.
In addition, within our MikroTik router, we have defined authorized and unauthorized communications using the built-in firewall. These configurations may vary depending on the specific network environment. Furthermore, if an external firewall is deployed, the corresponding security rules can also be configured within that device to enhance network protection.
Under normal conditions, all clients can easily establish communication with the designated backup server IP address. However, the issue arises when the backup server itself cannot fully communicate with the clients. This occurs because the server is unable to determine the correct routing path to reach their IP addresses, resulting in confusion during the return traffic process.
In other words, the return routing path encounters difficulties, as multiple routes exist within the backup server for sending response traffic. Typically, only one of these routes functions correctly, while the others remain unused, causing incomplete or unstable connections.
To address this issue, within our Windows Server — where Veeam Backup is installed — we apply a specific configuration using the Command Prompt (CMD) environment. Additionally, we ensure that this configuration is persistently stored, so it remains active even after a server restart or shutdown.
When our configuration and connections are designed in this manner, even if all backup-related ports become fully saturated during job execution, the Remote Desktop connections and other administrative access sessions initiated from the network administrator’s system will remain stable and uninterrupted.
A similar approach can also be implemented in Zabbix systems and other similar platforms. However, it is important to note that the configuration of static routes in such systems — particularly those based on Linux environments — differs slightly in syntax and procedure, although the overall concept remains fundamentally the same.
I hope this article has provided valuable insights and practical guidance to assist you in designing a more efficient and well-structured network infrastructure.
I hope this article has provided valuable insights and practical guidance to assist you in designing a more efficient and well-structured network infrastructure.
Written by: Ali Zare
🔗 LinkedIn
📸 Instagram
✍️ Medium
💻 GitHub
