# Map SureBackup masquerade routes before inviting testers

> Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.

- Canonical URL: https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T00:43:20+00:00
- Modified: 2026-10-15T00:44:33+00:00
- Last reviewed by DSE: 2026-10-14
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.

## Potentially affected

Use this guide when arranging approved tester access to a Veeam virtual lab. Confirm the applicable Veeam release and the actual lab topology before adding routes.

## DSE recommendation

DSE recommends a short access sheet listing the lab owner, isolated network, masquerade network, allowed testers, expected service, and test window.

## Article

Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.

## Source facts

Veeam explains that a VM in a virtual lab keeps its production IP address inside the isolated environment and is reached externally through a different masquerade address. The proxy appliance maps that address to the lab VM. The backup server receives a route when the lab starts, but other client machines need their own routes for access. Veeam documents these automatically created backup-server routes as nonpersistent and removed when the lab stops.

Source: [Veeam — IP Masquerading](https://helpcenter.veeam.com/docs/vbr/userguide/surebackup_ip_masquerading.html).

## Applicability

Use this guide when arranging approved tester access to a Veeam virtual lab. Confirm the applicable Veeam release and the actual lab topology before adding routes.

## DSE recommendation

DSE recommends a short access sheet listing the lab owner, isolated network, masquerade network, allowed testers, expected service, and test window. Check address ranges against existing networks before introducing them. Review the lab’s isolation and any access exceptions with the recovery owner. Give testers the approved masquerade destination instead of expecting their machines to follow the backup server’s route automatically. Plan route cleanup and a clear end to the access window.

## Verification

From the backup server and an authorized tester separately, check the intended application destination and return path. Verify lab isolation under the approved test plan. Stop the lab and confirm that temporary access and routes have been retired as intended.

## Official reference

[Veeam — IP Masquerading](https://helpcenter.veeam.com/docs/vbr/userguide/surebackup_ip_masquerading.html). Reviewed October 14, 2026.

## Primary reference

- Name: Veeam — IP Masquerading
- Authority: helpcenter.veeam.com
- URL: https://helpcenter.veeam.com/docs/vbr/userguide/surebackup_ip_masquerading.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Map SureBackup masquerade routes before inviting testers,” DSE Security, https://update.dsesecurity.com/updates/veeam-surebackup-masquerade-client-routing/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.