How to Deploy FLR Relay Proxy

Summary

To use your own TLS certificate during file-level restore and have the static Veeam Backup browser link:

1. In AWS CloudFormation, deploy and configure an EC2 instance that will act as an FLR relay proxy.
   In stack settings, you will need to specify the path to the TLS certificate and desired public DNS name. To obtain the stack template file, contact Veeam Customer Support.
2. In worker instance settings, specify the FLR relay proxy for each AWS region where you plan to perform file-level restore.
   During file-level restore, Veeam Backup for AWS will route traffic to and from the launched worker instance through the specified FLR relay proxy.

Prerequisites

• A valid TLS certificate. (For example, obtained from Let’s Encrypt.)
  The TLS certificate must be located in an S3 bucket folder.
• Public DNS name that you own. (For example, flr.domain.com)

Deploying FLR Relay Proxy in AWS CloudFormation

In AWS CloudFormation, for each AWS region where you plan to use the FLR relay proxy, complete the following steps:

1. Launch the Create Stack wizard as described in AWS Documentation.
2. At the Specify template step of the wizard, upload a template file obtained from Veeam Customer Support.
3. At the Specify stack details step of the wizard, specify the following settings:
   1. In the Stack name field, specify a name for the EC2 instance that will act as an FLR relay proxy.
      
   2. From the Key Pair drop-down list, select a key pair that will be used to authenticate against the FLR relay proxy.
      You will require the specified key pair if you want to connect to the proxy over SSH.
   3. [Optional] In the SSH Location field, specify the IPv4 address range from which you want to access the FLR relay proxy over SSH.
   4. In the HTTPS Location field, specify the IPv4 address range from which you plan to access the Veeam Backup browser during file-level restore.
   5. From the VPC and Subnet drop-down lists, select an Amazon Virtual Private Cloud (Amazon VPC) and subnet to which the FLR relay proxy must be connected.
   6. In the DNS Name field, specify the public DNS name that you own and want to include in the Veeam Backup browser link.
      
   7. In the S3 bucket with certificate field, specify the bucket folder name where the TLS certificate you want to use is located (without ‘s3://’).
      For example, MyBucketName/certificates
   8. In the Certificate file name field, specify the name of the certificate file that is located in the specified bucket folder.
      For example, certificate.pem
   9. In the Key file name field, specify the name of the private key file that is located in the specified bucket folder.
      For example, privatekey.pem
      
4. At the Configure stack options step of the wizard, specify AWS tags, IAM role permissions, and other additional settings if necessary, and then click Next.
5. At the Review step of the wizard, review the specified settings, select the I acknowledge that AWS CloudFormation might create IAM resources check box, and click Create stack.
6. Associate the DNS name specified at step 3f with the Elastic IP address that is assigned to the FLR relay proxy.
   To view the public IP address of the FLR relay proxy:
   1. Open the Amazon EC2 console.
   2. In the navigation pane, click Instances.
   3. Find and click your FLR relay proxy.
   4. On the Description tab, on the right of the IPv4 Public IP, you will find the IP address of the FLR relay proxy.
7. Wait until the FLR relay proxy is deployed.
   You can track the proxy deployment progress in the execution log at http://<IPaddress-of-your-proxy>:80.

After the successful installation of proxy components, the proxy will automatically shut down.

If this does not happen, check the proxy deployment status in the execution log at http://<IPaddress-of-your-proxy>:80 and contact Veeam Customer Support.