Proxmox Backup Server is excellent for homelabs and small environments, but when your infrastructure grows — or when compliance requirements land on your desk — enterprise teams increasingly reach for Veeam Backup & Replication. As of Veeam v12.1, Proxmox VE is a fully supported platform, meaning you get the same agentless backup, instant VM recovery, and immutable repository features that VMware and Hyper-V admins have relied on for years.

This guide walks you through the complete setup: connecting your Proxmox cluster to Veeam, configuring agentless backup jobs, setting up an immutable Linux hardened repository, and testing instant VM recovery. Whether you're protecting a production homelab or a small business environment, this workflow gives you enterprise-grade confidence.

Prerequisites

Before diving in, make sure you have the following in place:

Veeam Backup & Replication v12.1 or later installed on a Windows Server 2019/2022 machine (the VBR server).
Proxmox VE 8.x with at least one node — a cluster is supported but not required.
A dedicated Linux VM or bare-metal server for the hardened repository (Ubuntu 22.04 LTS recommended).
Network connectivity between the VBR server and your Proxmox nodes on port 443 (Proxmox API) and 2500–3300 (Veeam data transport).
A Proxmox API user with the PVEAuditor and PVEDatastoreUser roles — we'll create this below.

Veeam offers a free Community Edition that covers up to 10 workloads, which is plenty for most homelabs.

Creating a Proxmox API User for Veeam

Veeam communicates with Proxmox through the REST API. You should create a dedicated, least-privilege user rather than handing over root credentials.

Step 1 — Create the user and role

SSH into your Proxmox node and run:

# Create a dedicated Veeam user in the PAM realm
pveum user add veeam@pam --comment "Veeam Backup Service Account"

Create a custom role with the minimum required privileges

pveum role add VeeamBackup -privs
"VM.Audit,VM.Backup,VM.Config.Disk,VM.Config.CDROM,
VM.Config.CPU,VM.Config.Memory,VM.Config.Network,
VM.Config.Options,VM.Monitor,VM.PowerMgmt,
Datastore.AllocateSpace,Datastore.AllocateTemp,
Datastore.Audit,SDN.Use,Sys.Audit"

Assign the role to the user at the root path

pveum aclmod / -user veeam@pam -role VeeamBackup

Step 2 — Set an API token (recommended over password)

# Generate an API token for the veeam user
pveum user token add veeam@pam veeam-token --privsep 0

Copy the token secret — it's only shown once. You'll enter it in Veeam's credential manager.

Adding Proxmox to Veeam Backup & Replication

Open the Veeam Backup & Replication console on your Windows server.

Add the Proxmox server

Navigate to Inventory → Virtual Infrastructure.
Right-click Add Server and select Proxmox VE.
Enter the hostname or IP address of your Proxmox node (or the cluster VIP if you have one).
Under Credentials, click Add and choose Linux credentials for PAM auth, or select API Token and paste the token ID (veeam@pam!veeam-token) and secret.
Accept the SSH fingerprint when prompted — Veeam installs a lightweight transport component on the Proxmox host for agentless operations.

Veeam will enumerate your VMs, storage, and cluster nodes automatically. If you're running a cluster, add the cluster IP rather than individual node IPs so Veeam can follow live-migrated VMs.

Verify the connection

Expand the Proxmox server in the inventory tree. You should see your node(s), storage pools, and all VMs listed. Green icons indicate healthy API connectivity.

Setting Up a Linux Hardened Repository

Immutable backups are the most important ransomware defense in your arsenal. Veeam supports immutability on Linux repositories using the chattr +i approach — once a backup file is written and the immutability flag is set, even root cannot delete it until the retention period expires.

Prepare the Ubuntu repository server

On your Ubuntu 22.04 VM, create a dedicated user and directory:

# Create a non-root repository user
useradd -m -s /bin/bash veeamrepo
passwd veeamrepo

Create the backup storage directory

mkdir -p /backup/veeam chown veeamrepo:veeamrepo /backup/veeam chmod 700 /backup/veeam

Ensure the XFS or ext4 filesystem supports immutability

XFS is recommended — format your dedicated disk:

mkfs.xfs -f /dev/sdb mount /dev/sdb /backup echo "/dev/sdb /backup xfs defaults 0 0" >> /etc/fstab

Important: The repository OS user must have sudo rights for chattr but should NOT have unrestricted sudo. Veeam handles this with a targeted sudoers entry it configures automatically during repository setup.

Add the hardened repository in Veeam

In the Veeam console, go to Backup Infrastructure → Backup Repositories.
Click Add Repository → Direct Attached Storage → Linux.
Enter the IP of your Ubuntu server and the veeamrepo credentials.
Veeam will install its transport agent via SSH.
Set the path to /backup/veeam.
On the Repository settings page, check Make recent backups immutable for: 7 days (or your desired retention).
Enable Use per-machine backup files for granular restore flexibility.

Once added, the repository shows an immutability lock icon in the console.

Creating an Agentless Backup Job

Agentless backup is the flagship feature for virtual infrastructure — no software installed inside the guest VM, snapshots handled at the hypervisor level.

Configure the job

Go to Home → Backup Jobs → Virtual Machine.
Name the job (e.g., Proxmox-Daily-Backup).
On the Virtual Machines step, click Add and browse your Proxmox inventory. Select individual VMs, entire nodes, or resource pools.
Set the Destination to your hardened Linux repository.
Configure Retention Policy: 14 restore points is a good starting point for most environments.

Schedule and advanced settings

On the Schedule step:

Set a daily backup window (e.g., 2:00 AM).
Enable Retry failed job items — set to 3 retries with a 10-minute delay.
Check Backup window to prevent the job from running during business hours if needed.

Under Advanced Settings → Storage:

Set compression to Optimal (LZ4 — good balance of speed and ratio).
Enable Inline data deduplication if your VMs share common OS images.
For Windows VMs, enable Application-aware processing to get VSS-consistent backups.

Job Summary (example configuration): ───────────────────────────────────── Job name: Proxmox-Daily-Backup VMs: All (12 VMs across 2 nodes) Repository: Ubuntu-Hardened-Repo Retention: 14 restore points Immutability: 7 days Schedule: Daily at 02:00 Compression: Optimal (LZ4) Dedup: Enabled App-aware: Enabled (Windows VMs)

Run the job manually first

Right-click the job and select Start. Watch the Job Sessions panel for progress. The first run is a full backup — subsequent runs use incremental forever with synthetic full synthesis.

Expect roughly 100–150 MB/s throughput on a 1GbE network with average compression ratios of 2:1 to 3:1 for typical VM workloads.

Instant VM Recovery

Instant VM recovery is where Veeam earns its reputation. You can spin up a VM directly from the compressed backup file in under 2 minutes, run it in production, then migrate the changes back to the target datastore.

Trigger an instant recovery

In the Veeam console, go to Home → Backups → Disk.
Expand your backup job and right-click the VM you want to recover.
Select Instant Recovery → Proxmox VM.
Choose the restore point (date/time).
Select the target Proxmox node and storage pool.
Under Recovery mode, choose:
- Restore to the original location — overwrites the existing VM.
- Restore to a new location — creates a new VM, lets you rename it.
Leave Connect VM to network checked if you want it live immediately.
Click Finish — the VM boots from the backup repository within seconds.

The VM runs directly from the Veeam repository (vPower NFS mount) while storage migration happens in the background. Once migration completes, Veeam redirects disk I/O to the production datastore seamlessly.

File-level recovery

For granular restores — recovering a single deleted file without restoring an entire VM:

Right-click the backup → Restore guest files → Linux (or Windows).
Veeam mounts the backup as a virtual disk in a temporary Linux helper appliance.
Browse the filesystem, select files, and restore them to the original VM or download locally.

This is particularly useful for recovering accidentally deleted configuration files or databases without spinning up a full VM restore.

Monitoring and Alerting

Veeam's built-in reporting covers most needs, but connecting it to your existing monitoring stack improves visibility.

Email notifications

In Options → Notifications, configure SMTP settings to receive job completion emails. Set alerts for:

Job failures
Warnings (missed VMs, snapshot removal failures)
Success (optional, can get noisy)

Veeam ONE integration

If you have Veeam ONE (included in Veeam Universal License), you get a web dashboard with:

Backup window compliance heatmaps
Repository capacity forecasting
RPO violation alerts
Infrastructure resource usage trends

For homelab users on the free Community Edition, the built-in console statistics and email reports are sufficient.

Checking immutability status via CLI

You can verify immutability flags are applied on the repository server:

# List immutable files in the backup directory
lsattr /backup/veeam/ | grep '\-\-\-i'

Example output:

----i--------e-- /backup/veeam/JobName/2026-04-02T020000.vbk ----i--------e-- /backup/veeam/JobName/2026-04-02T020000.vib

The i flag means the file cannot be modified or deleted by any user, including root, until the immutability period expires.

Backup Copy Jobs for Offsite Protection

Following the 3-2-1 rule (3 copies, 2 media types, 1 offsite), configure a Backup Copy Job to replicate backups to a second location.

3-2-1 Example for Proxmox with Veeam: ───────────────────────────────────── Copy 1: Primary VM storage (Proxmox local/ZFS) Copy 2: Veeam hardened repository (local NAS/server) Copy 3: Backup copy job → cloud (Wasabi, Backblaze B2) OR → second site (VPN-connected Proxmox node)

To add Backblaze B2 as a cloud repository:

Go to Backup Infrastructure → Object Storage Repositories.
Select S3 Compatible and enter Backblaze B2 endpoint details.
Create a Scale-Out Backup Repository combining your local hardened repo with the B2 object storage tier.
Veeam automatically offloads older restore points to object storage while keeping recent points local for fast recovery.

Common Troubleshooting

Snapshot removal failures

If you see warnings about snapshot removal taking too long, the Proxmox host is likely under heavy I/O during backup. Solutions:

Schedule backups during low-activity windows.
Enable Parallel processing in job advanced settings to spread snapshot commits.
Increase the snapshot removal timeout in Options → Timeouts.

Transport agent connectivity issues

If Veeam can't reach the transport agent on the Proxmox host:

# Check Veeam transport service on Proxmox node
ss -tlnp | grep 2500

If not listening, check the service

systemctl status veeamtransport systemctl restart veeamtransport

Also verify your Proxmox firewall isn't blocking ports 2500–3300 from the VBR server IP.

API token permission errors

If jobs fail with permission errors, verify the API token has privsep=0 (no privilege separation) and the role includes VM.Backup:

# Check token permissions
pveum user token list veeam@pam

Verify role assignment

pveum acl list | grep veeam

Conclusion

Veeam Backup & Replication v12.1 brings enterprise-grade data protection to Proxmox VE without the complexity overhead you'd expect. The agentless architecture means zero guest-side agents to manage, instant VM recovery gets you back online in minutes rather than hours, and immutable repositories give you a last line of defense against ransomware that even PBS can't match.

For homelab users, the free Community Edition covering 10 workloads removes any cost barrier to getting started. For production environments, the Universal License unlocks the full feature set including Veeam ONE monitoring and unlimited scale-out repositories.

Start with a single backup job protecting your most critical VMs, validate recovery works with a test instant restore, then expand coverage as confidence grows. A backup you haven't tested is just a file — make recovery drills part of your routine.

Veeam Backup for Proxmox VE: Complete Setup Guide