How do I choose and add a backup destination?
A destination is where backups are stored. BackupWall supports Amazon S3 and S3-compatible storage (including Wasabi and Backblaze B2), Google Cloud Storage, Google Drive, OneDrive, SFTP, and local or NFS folders. Add one under Destinations and use Test to prove it works.
Supported destinations
| Destination | Notes | Tested by PortWall |
|---|---|---|
| Local / NFS | A folder on the server or a mounted share. Not a backup if it is the same disk. | Yes |
| SFTP | Password or private key. Pins the server's host key. | Yes |
| Google Drive | Service account only. About 2.5 requests per second. | Yes |
| Amazon S3 and S3-compatible (MinIO and others) | Custom endpoint URL for non-AWS stores. | One third-party S3-compatible bucket, over a slow long-distance link |
| Wasabi, Backblaze B2 | Use the same S3 code. | No real runs on record yet |
| Google Cloud Storage via the S3 type with HMAC keys | The route that works in organizations that block service account keys. | Yes, on a 1 TB server |
| Google Cloud Storage, native type (service account JSON) | Needs a service account key file. | No real runs on record yet |
| OneDrive | Microsoft 365 work or school accounts only. | Mock only, never against a real tenant |
| Dropbox | Not available. | - |
Add a destination
- Open Destinations and choose + Add destination.
- Pick a provider.
- Fill in the form. Display name is required. Leave Destination enabled ticked so jobs can write to it.
- Choose Add destination.
- On the new destination's card, choose Test. You should see "Connection successful".
You must create the destination first: the form has no test button. Credentials are encrypted in BackupWall's database with the master key in /etc/backupwall/backupwall.env.
Provider articles: Amazon S3 and compatible, Google Drive, Google Cloud Storage, SFTP, Local and NFS, OneDrive.
How data is stored
- On remote destinations, backups are stored as large content-addressed pack files of about 32 MB, not as one file per object. A local destination does not use packs.
- Remote data is not browsable as ordinary files. You need BackupWall and the master key, or the read-only
bw-extracttool, to read it. See Get your files out without BackupWall. - Backups are not encrypted at the destination unless the job has Encrypt backup data on. See Encrypt your backups.
- Treat the destination as secret storage: use a private bucket or a locked-down SFTP account.
Rules to follow
- Two BackupWall installs must not share a bucket or folder. The cleanup decides what is unused from one install's database only, so a second install could have its data deleted. Give each install its own bucket or path prefix.
- Deleting a destination in the console only turns it off. Its data is left alone.
- Nothing copies backups from one destination to another after the fact. A job writes to the destination you pick.
- Keep a remote copy. A local destination on the same disk is fine for a first run but is not a backup you can rely on.
- Use Rescan destination (on the destination's card) after a rebuild to import backup points the database does not know. See Rebuild a server from a DR bundle.
If Test fails
Still stuck? Open a ticket at portwall.net/billing or write to [email protected], and attach a support bundle. See Report a problem and make a support bundle.