How to Set Up Proxmox Backup Server

If you run Proxmox VE in a home lab or business environment, you already have a basic backup mechanism built in — but it has real limitations. Proxmox Backup Server (PBS) is a separate, free product from Proxmox that transforms how you protect virtual machines and containers. It brings enterprise-grade features like deduplication, compression, encryption, and integrity verification to environments of any size. For UK businesses working towards Cyber Essentials certification — which explicitly requires demonstrable, tested backup and recovery processes — PBS provides the audit trail and restore confidence that a simple dump backup cannot. When combined with the 3-2-1 rule (three copies of your data, on two different media, with one off-site), PBS becomes the backbone of a properly resilient infrastructure.

PBS vs Proxmox VE’s Built-in Backup

Proxmox VE includes a native backup tool that saves VMs and containers as .vma or .tar dump files to any storage target. It works, but every backup is a full copy — there is no deduplication between jobs, and storage consumption grows quickly. Proxmox Backup Server uses a chunked, content-addressed storage format. Identical blocks across multiple VMs or successive backups are stored only once. In practice, a server with ten similar Ubuntu VMs might consume 80–90% less storage than equivalent VMA dumps. PBS also compresses chunks by default and supports AES-256 encryption for backups destined for off-site or cloud storage.

Step 1: Install Proxmox Backup Server

PBS is a standalone Debian-based appliance, not a package you install on top of PVE. Download the ISO from the official Proxmox website and install it on dedicated hardware or as a VM on a separate host. The installer is identical to the Proxmox VE installer: boot from the ISO, accept the EULA, select a target disk, configure network settings, and set a root password. For genuine off-site protection, PBS should run on a physically separate host from your PVE cluster — if the hypervisor fails or is compromised, you want your backup server untouched.

1. Download the PBS ISO from proxmox.com/en/downloads.
2. Write it to a USB drive using Rufus or Balena Etcher.
3. Boot the target machine from the USB and follow the guided installer.
4. Once installed, access the web UI at https://<PBS-IP>:8007 and log in as root.

Step 2: Create a Datastore

A datastore is the directory where PBS stores backup chunks. It should live on a dedicated disk or partition — not the system disk.

1. In the PBS web UI, go to Administration > Storage / Disks.
2. Select an unformatted disk and click Initialise Disk with GPT.
3. Go to Administration > Storage / Disks > Directory and create a new ext4 filesystem on that disk.
4. Navigate to Datastore > Add Datastore, give it a name (e.g., pve-backups), and point it at the directory you just created.

Once created, the datastore dashboard shows usage, deduplication ratio, and snapshot counts in real time.

Step 3: Add PBS as a Storage Target in Proxmox VE

With PBS running and a datastore configured, connect it to your PVE environment.

1. In the PVE web UI, go to Datacenter > Storage > Add > Proxmox Backup Server.
2. Enter the PBS server IP or hostname, the datastore name, and your PBS credentials (root or a dedicated backup user).
3. PVE will fetch the server’s fingerprint — verify it matches the fingerprint shown in the PBS web UI under Administration > Certificates.
4. Save the storage. It will now appear as an available backup target across your PVE nodes.

Step 4: Create a Backup Job

Backup jobs in PVE define which VMs and containers to back up, when, and for how long to keep them.

1. Go to Datacenter > Backup > Add.
2. Select your PBS storage as the target.
3. Choose a schedule — daily at 02:00 is a sensible default for most environments.
4. Select the VMs and containers to include, or choose All.
5. Set a retention policy: for example, keep the last 7 daily, 4 weekly, and 3 monthly backups. PBS enforces this automatically, pruning older snapshots during each job run.
6. Set the compression mode to ZSTD (the default) for an excellent speed-to-ratio trade-off.

If you need encryption — strongly recommended for any backups leaving the premises — tick Encryption and save the generated key somewhere safe and separate from the PBS server itself. A lost encryption key means lost backups.

Step 5: Run a Verify Job

PBS can verify backup integrity without a full restore. Verify jobs read every chunk of a backup and confirm the content matches the stored checksums, catching silent data corruption before you need to rely on a backup in an emergency. This is a critical differentiator from plain dump-file backups, where corruption often goes undetected until a restore fails.

1. In the PBS web UI, go to your datastore and select Verify Jobs > Add.
2. Schedule weekly verification runs.
3. Failed verifications are flagged clearly in the task log — investigate and re-run the affected backup job immediately.

For Cyber Essentials Plus or ISO 27001 evidence purposes, the PBS task log provides a dated, itemised record of every backup, prune, and verify operation.

Step 6: Restore a VM from PBS

Restoring is straightforward and can be done without the original VM existing.

1. In PVE, go to the PBS storage in the left-hand tree and browse to Backups.
2. Select the VM snapshot you want to restore and click Restore.
3. Choose the target node, storage, and VM ID (you can restore to a new ID to run alongside the original).
4. PBS streams the backup directly, reconstructing the VM from deduplicated chunks. Restore times are comparable to full-backup restore speeds.

Test your restores regularly. UK businesses pursuing Cyber Essentials are required to demonstrate that backups can be successfully restored — scheduling a quarterly restore test and logging the result is the minimum recommended practice.

Off-site and the 3-2-1 Rule

The 3-2-1 rule states you need three copies of data, on two different media types, with one copy off-site. PBS makes the off-site copy practical: run a second PBS instance on a VPS or at a secondary site, use PBS’s built-in Sync Jobs (under the datastore) to replicate backups from your primary PBS to the remote one, and enable encryption so data is protected in transit and at rest. Your primary PBS holds recent, fast-access backups; the remote PBS holds the off-site copy. Ransomware that encrypts your PVE hosts and local PBS cannot reach an air-gapped or network-isolated remote PBS instance.