Map SureBackup masquerade routes before inviting testers

Distinguish a recovered machine’s isolated production address from the masquerade address used to reach a SureBackup lab.

Source facts

Veeam explains that a VM in a virtual lab keeps its production IP address inside the isolated environment and is reached externally through a different masquerade address. The proxy appliance maps that address to the lab VM. The backup server receives a route when the lab starts, but other client machines need their own routes for access. Veeam documents these automatically created backup-server routes as nonpersistent and removed when the lab stops.

Source: Veeam — IP Masquerading.

Applicability

Use this guide when arranging approved tester access to a Veeam virtual lab. Confirm the applicable Veeam release and the actual lab topology before adding routes.

DSE recommendation

DSE recommends a short access sheet listing the lab owner, isolated network, masquerade network, allowed testers, expected service, and test window. Check address ranges against existing networks before introducing them. Review the lab’s isolation and any access exceptions with the recovery owner. Give testers the approved masquerade destination instead of expecting their machines to follow the backup server’s route automatically. Plan route cleanup and a clear end to the access window.

Verification

From the backup server and an authorized tester separately, check the intended application destination and return path. Verify lab isolation under the approved test plan. Stop the lab and confirm that temporary access and routes have been retired as intended.

Official reference

Veeam — IP Masquerading. Reviewed October 14, 2026.