← All break/fix scenarios in Proxmox VE
PBS sync job to offsite fails with "connection refused"
Reported symptoms
- ●PBS sync job fails with "connection refused" or "TLS handshake failed"
- ●GUI shows the sync job with status "Error"
- ●The offsite PBS is reachable on the network
- ●The sync job worked yesterday
Evidence
- · proxmox-backup-manager sync job list shows last status "Error"
- · curl -k https://<offsite>:8007 fails with connection refused
- · ssh root@<offsite> "systemctl status proxmox-backup-proxy"
- · iptables -L -n | grep 8007 (port check)
Diagnosis and resolutionclick to reveal
Root cause
The remote PBS is unreachable on port 8007. Common causes: - The remote PBS service stopped (OOM, crash, manual stop) - Firewall rule blocks port 8007 - VPN tunnel to the remote site is down - DNS no longer resolves the remote PBS hostname - TLS certificate expired on the remote PBS
Remediation
1. Test basic connectivity: `ping <offsite-pbs>` `dig <offsite-pbs>` (DNS resolution) 2. Test the PBS port directly: `curl -k https://<offsite-pbs>:8007` - Connection refused: PBS service down - Timeout: firewall / VPN issue - TLS error: certificate issue 3. If PBS is down: `ssh root@<offsite-pbs> systemctl status proxmox-backup-proxy` `ssh root@<offsite-pbs> systemctl start proxmox-backup-proxy` Check logs: `journalctl -u proxmox-backup-proxy -e` 4. If firewall issue: `ssh root@<offsite> iptables -L -n | grep 8007` Allow port: `iptables -A INPUT -p tcp --dport 8007 -j ACCEPT` 5. If VPN issue: Check the tunnel status, restart if needed 6. If certificate issue: Renew on the remote PBS or update the fingerprint in the sync job config 7. Re-run the sync job: `proxmox-backup-manager sync job run <job-id>`
Verification
- `curl -k https://<offsite>:8007` returns the PBS API - The sync job runs and completes successfully - New chunks appear in the offsite datastore - Bandwidth usage matches expected (use vnstat or iftop)
Prevention
- Monitor the offsite PBS with a separate health check - Alert when sync job fails 2x in a row - Test connectivity weekly from a third party - Document the offsite PBS host and credentials in a runbook