TrueNAS as an Immutable Backup Target for Veeam & Proxmox (S3 Object Lock)

Ransomware campaigns now target the backups first — a victim with no recovery point is more likely to pay. The most effective answer is immutability: backups that cannot be changed or deleted for a defined retention period — not even by a compromised admin account. With TrueNAS you build such an immutable backup target on-premises: S3-compatible, with Object Lock, without cloud egress.

Why immutable, not “just” backup

A classic backup can be deleted or overwritten — and that is exactly what modern ransomware does before it encrypts. Immutable backups close that gap via S3 Object Lock in Compliance or Governance mode: objects get a retention period during which they are technically unchangeable. That is the “1” in the 3-2-1-1-0 rule — the offline/immutable copy.

TrueNAS as an S3 immutable target

TrueNAS has everything needed to serve an immutable object target:

• S3-compatible object storage straight from the ZFS pool.
• Object Lock / retention for WORM behavior (write once, read many).
• ZFS checksums & scrubs — detect and heal bit-rot so the immutable backup is still intact months later.
• Snapshots as a second layer — even below the object level.
• On-premises & free on restore — no egress, full control over the physical location.

Veeam on TrueNAS: the path

In Veeam you add TrueNAS as an S3-compatible object storage repository and enable “Make recent backups immutable for N days” on creation. Veeam then uses Object Lock to seal the restore points for the chosen period:

1. Create a bucket on TrueNAS with Object Lock enabled.
2. Add it in Veeam as an object storage repository, set the immutability period.
3. Point a backup job (or backup copy job) at the repository — your immutable copy is done.

A backup copy job to the TrueNAS target is recommended, so the immutable copy is created independently of the primary repository.

Proxmox Backup Server & TrueNAS

TrueNAS is also the ideal foundation in Proxmox environments: the Proxmox Backup Server (PBS) sits perfectly on TrueNAS storage (iSCSI/NFS), and for object-based or two-tier strategies the S3 immutable target serves as the air-gapped second copy. Combined with ZFS replication you get layered protection — fast locally, immutable off-site.

Sizing: how big should the target be?

The right size depends on backup volume, retention and change rate. Rule of thumb: immutable retention needs headroom, because sealed objects are only released after the period expires. This is exactly where the TrueNAS configurator helps: you instantly see usable capacity after RAID/ZFS, expandability and power cost.

→ Size your backup target in the TrueNAS configurator

Conclusion

Immutable backups are the most effective protection against ransomware — and with TrueNAS as an S3 immutable target with Object Lock you get them on-premises, integrity-assured by ZFS and without cloud egress. For Veeam and Proxmox Backup Server alike, TrueNAS is the robust foundation of the immutable copy.

As an authorized TrueNAS reseller in Germany, we size your immutable target to fit your backup volume. Configure now or get in touch for a quote.