Symptoms
A JetBackup Storage destination may fail with errors similar to:
Error: Failed to connect to us-east-1.storage.jetbackup.com port 443: Connection refused. Failed connecting destination "JetBackup Storage" (#DESTINATION_ID). Error: Connection timed out after 30001 milliseconds.
Error: Failed to connect to eu-central-2.storage.jetbackup.com port 443: Connection refused.
Cause
A regional JetBackup Storage endpoint may resolve to multiple IP addresses. If CSF or another firewall blocks one of those IPs, connections may succeed or fail depending on which IP is selected.
Test All Endpoint IPs
Replace REGION.storage.jetbackup.com with your bucket regional endpoint. The following command resolves all current IPs and tests each one directly over HTTPS:
HOST="REGION.storage.jetbackup.com"; for IP in $(getent ahostsv4 "$HOST" | awk '{print $1}' | sort -u); do printf "%-15s : " "$IP"; curl -sS -o /dev/null --connect-timeout 5 --max-time 10 --resolve "${HOST}:443:${IP}" -w "Got HTTP Code: %{http_code}\n" "https://${HOST}/" && echo "Connection succeeded" || echo "Connection failed"; doneAn HTTP response such as 200, 400, 403, or 404 confirms that the connection reached the endpoint. Errors such as Connection refused or Connection timed out indicate that the connection is being blocked or rejected.
Check CSF
Use the following command to check every resolved IP against the active CSF rules. This command does not make any changes in CSF, only greps the IPs from iptables.
HOST="REGION.storage.jetbackup.com"; for IP in $(getent ahostsv4 "$HOST" | awk '{print $1}' | sort -u); do echo "===== $IP ====="; csf -g "$IP"; done
Resolution
With the help and confirmation of the server administrator, permanently allow outbound TCP port 443 to all IP addresses currently returned by the regional endpoint.
Add the IP addresses to:
/etc/csf/csf.allowYou can also quickly add with the command: csf -a IP_ADDRESS "JetBackup Storage"
After updating the firewall configuration, reload CSF:
csf -rTemporary CSF allow rules are not a permanent solution because they expire after their configured lifetime.
Verification
Run the endpoint test again and confirm that every resolved IP returns an HTTP response. Then retry the JetBackup Storage destination.
