{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/veeam-surebackup-masquerade-client-routing/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/",
        "slug": "veeam-surebackup-masquerade-client-routing",
        "url": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/veeam-surebackup-masquerade-client-routing/"
        },
        "title": "Map SureBackup masquerade routes before inviting testers",
        "summary": "Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T00:43:20+00:00",
        "modified_at": "2026-10-15T00:44:33+00:00",
        "reviewed_on": "2026-10-14",
        "reading_minutes": 2,
        "word_count": 246,
        "potentially_affected": "Use this guide when arranging approved tester access to a Veeam virtual lab. Confirm the applicable Veeam release and the actual lab topology before adding routes.",
        "dse_recommendation": "DSE recommends a short access sheet listing the lab owner, isolated network, masquerade network, allowed testers, expected service, and test window.",
        "primary_source": {
            "name": "Veeam — IP Masquerading",
            "url": "https://helpcenter.veeam.com/docs/vbr/userguide/surebackup_ip_masquerading.html",
            "published_on": null,
            "authority": "helpcenter.veeam.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.</p>\n<h2>Source facts</h2>\n<p>Veeam explains that a VM in a virtual lab keeps its production IP address inside the isolated environment and is reached externally through a different masquerade address. The proxy appliance maps that address to the lab VM. The backup server receives a route when the lab starts, but other client machines need their own routes for access. Veeam documents these automatically created backup-server routes as nonpersistent and removed when the lab stops.</p>\n<p>Source: <a href=\"https://helpcenter.veeam.com/docs/vbr/userguide/surebackup_ip_masquerading.html\">Veeam — IP Masquerading</a>.</p>\n<h2>Applicability</h2>\n<p>Use this guide when arranging approved tester access to a Veeam virtual lab. Confirm the applicable Veeam release and the actual lab topology before adding routes.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends a short access sheet listing the lab owner, isolated network, masquerade network, allowed testers, expected service, and test window. Check address ranges against existing networks before introducing them. Review the lab’s isolation and any access exceptions with the recovery owner. Give testers the approved masquerade destination instead of expecting their machines to follow the backup server’s route automatically. Plan route cleanup and a clear end to the access window.</p>\n<h2>Verification</h2>\n<p>From the backup server and an authorized tester separately, check the intended application destination and return path. Verify lab isolation under the approved test plan. Stop the lab and confirm that temporary access and routes have been retired as intended.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://helpcenter.veeam.com/docs/vbr/userguide/surebackup_ip_masquerading.html\">Veeam — IP Masquerading</a>. Reviewed October 14, 2026.</p>",
        "content_text": "Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.\nSource facts\nVeeam explains that a VM in a virtual lab keeps its production IP address inside the isolated environment and is reached externally through a different masquerade address. The proxy appliance maps that address to the lab VM. The backup server receives a route when the lab starts, but other client machines need their own routes for access. Veeam documents these automatically created backup-server routes as nonpersistent and removed when the lab stops.\nSource: Veeam — IP Masquerading.\nApplicability\nUse this guide when arranging approved tester access to a Veeam virtual lab. Confirm the applicable Veeam release and the actual lab topology before adding routes.\nDSE recommendation\nDSE recommends a short access sheet listing the lab owner, isolated network, masquerade network, allowed testers, expected service, and test window. Check address ranges against existing networks before introducing them. Review the lab’s isolation and any access exceptions with the recovery owner. Give testers the approved masquerade destination instead of expecting their machines to follow the backup server’s route automatically. Plan route cleanup and a clear end to the access window.\nVerification\nFrom the backup server and an authorized tester separately, check the intended application destination and return path. Verify lab isolation under the approved test plan. Stop the lab and confirm that temporary access and routes have been retired as intended.\nOfficial reference\nVeeam — IP Masquerading. Reviewed October 14, 2026.",
        "content_markdown": "Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.\n\n## Source facts\n\nVeeam explains that a VM in a virtual lab keeps its production IP address inside the isolated environment and is reached externally through a different masquerade address. The proxy appliance maps that address to the lab VM. The backup server receives a route when the lab starts, but other client machines need their own routes for access. Veeam documents these automatically created backup-server routes as nonpersistent and removed when the lab stops.\n\nSource: [Veeam — IP Masquerading](https://helpcenter.veeam.com/docs/vbr/userguide/surebackup_ip_masquerading.html).\n\n## Applicability\n\nUse this guide when arranging approved tester access to a Veeam virtual lab. Confirm the applicable Veeam release and the actual lab topology before adding routes.\n\n## DSE recommendation\n\nDSE recommends a short access sheet listing the lab owner, isolated network, masquerade network, allowed testers, expected service, and test window. Check address ranges against existing networks before introducing them. Review the lab’s isolation and any access exceptions with the recovery owner. Give testers the approved masquerade destination instead of expecting their machines to follow the backup server’s route automatically. Plan route cleanup and a clear end to the access window.\n\n## Verification\n\nFrom the backup server and an authorized tester separately, check the intended application destination and return path. Verify lab isolation under the approved test plan. Stop the lab and confirm that temporary access and routes have been retired as intended.\n\n## Official reference\n\n[Veeam — IP Masquerading](https://helpcenter.veeam.com/docs/vbr/userguide/surebackup_ip_masquerading.html). Reviewed October 14, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/",
                "url": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-14"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Map SureBackup masquerade routes before inviting testers",
                        "item": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/#article",
                "identifier": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/",
                "url": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/",
                "headline": "Map SureBackup masquerade routes before inviting testers",
                "description": "Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.",
                "abstract": "Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.",
                "articleBody": "Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.\nSource facts\nVeeam explains that a VM in a virtual lab keeps its production IP address inside the isolated environment and is reached externally through a different masquerade address. The proxy appliance maps that address to the lab VM. The backup server receives a route when the lab starts, but other client machines need their own routes for access. Veeam documents these automatically created backup-server routes as nonpersistent and removed when the lab stops.\nSource: Veeam — IP Masquerading.\nApplicability\nUse this guide when arranging approved tester access to a Veeam virtual lab. Confirm the applicable Veeam release and the actual lab topology before adding routes.\nDSE recommendation\nDSE recommends a short access sheet listing the lab owner, isolated network, masquerade network, allowed testers, expected service, and test window. Check address ranges against existing networks before introducing them. Review the lab’s isolation and any access exceptions with the recovery owner. Give testers the approved masquerade destination instead of expecting their machines to follow the backup server’s route automatically. Plan route cleanup and a clear end to the access window.\nVerification\nFrom the backup server and an authorized tester separately, check the intended application destination and return path. Verify lab isolation under the approved test plan. Stop the lab and confirm that temporary access and routes have been retired as intended.\nOfficial reference\nVeeam — IP Masquerading. Reviewed October 14, 2026.",
                "datePublished": "2026-10-15T00:43:20+00:00",
                "dateModified": "2026-10-15T00:44:33+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Map SureBackup masquerade routes before inviting testers"
                },
                "articleSection": [
                    "Business Continuity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Business Continuity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 246,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Veeam — IP Masquerading",
                    "url": "https://helpcenter.veeam.com/docs/vbr/userguide/surebackup_ip_masquerading.html"
                }
            }
        ]
    }
}