Bare-Metal Backups That Actually Work: Deploying UrBackup for Windows and Linux Fleets

The most dangerous trap in systems administration is relying solely on file-level backups. Backing up C:\Users or /home/ntadmin feels responsible until an OS drive gets corrupted, ransomware strikes, or a faulty Windows update causes a blue-screen boot loop. When disaster hits, restoring raw files onto a fresh Windows or Linux installation is an agonizing, multi-hour nightmare: reinstalling software, re-entering software licenses, reconstructing IIS or Apache configs, and restoring registry keys. What you actually need is true block-level bare-metal image backups.

While enterprise backup suites like Veeam and Datto are industry standards, their per-agent or per-socket subscription models can quickly become exorbitant for homelabs and small MSP fleets. UrBackup is the open-source hero of bare-metal imaging. It delivers client-side Change Block Tracking (CBT), Windows VSS snapshots, Linux LVM imaging, and instant VHD mounting. Here is how I deployed UrBackup on docker02, solved multi-VLAN client discovery, and established an automated image backup pipeline.

1. The Architecture: Why Host Networking is Required

UrBackup operates on a high-speed client-server model. When a workstation or server is online, the UrBackup agent communicates with the server over three dedicated ports:

• UDP 35623: Local LAN broadcast discovery.
• TCP 35621: Command and control channel.
• TCP 35622: High-throughput block data and image streaming.
• TCP 55414: Administrative Web UI and REST API.

Because Docker’s default virtual bridge network isolates UDP broadcast packets, running UrBackup behind standard Docker NAT breaks automatic LAN client discovery. To fix this, UrBackup runs in host networking mode:

# /opt/stacks/urbackup/docker-compose.yml
# Backups stored on dedicated 500 GiB virtual disk mounted at /srv/urbackup (xvdc)
services:
  urbackup:
    image: uroni/urbackup-server:latest
    container_name: urbackup
    restart: unless-stopped
    network_mode: host # Required for client discovery (UDP 35623) and high-speed streaming
    environment:
      - TZ=America/Chicago
    volumes:
      - /srv/urbackup/backups:/backups
      - /srv/urbackup/db:/var/urbackup
      - /etc/localtime:/etc/localtime:ro

The container binds directly to our secondary management IP (10.1.20.18:55414). Backups are written to a dedicated 500 GiB virtual disk (/dev/xvdc) mounted at /srv/urbackup, ensuring database transactions and multi-gigabyte image writes never contend with the host’s operating system root drive.

2. Conquering Multi-VLAN Client Discovery

The Multi-VLAN Gotcha: In a segmented network with 10 VLANs, UDP broadcast packets on NET-WORKSTATIONS-VLAN10 will never cross the UniFi Dream Machine gateway to reach the server on NET-SERVERS-VLAN20. By default, client machines appear offline.

There are two ways to solve this across an enterprise network:

1. Static Server Hints: In the UrBackup web console, navigate to Settings > Server > Internet/Active Clients and set the Server URL to http://10.1.20.18:55414. When downloading the customized Windows or Linux client installer, the server IP and cryptographic authentication token are pre-baked into the binary.
2. UniFi Firewall Exceptions: In our UniFi firewall matrix, we created a LAN In rule allowing established/related TCP traffic on ports 35621 and 35622 from NET-WORKSTATIONS-VLAN10 and NET-MGMT-VLAN1 to 10.1.20.18.

The moment the agent is installed on a Windows workstation or Linux host, it bypasses broadcast discovery, initiates a direct TLS-encrypted handshake to 10.1.20.18:35621, and reports ready for backup within 5 seconds.

3. Block-Level Imaging with Change Block Tracking (CBT)

The true power of UrBackup on Windows endpoints is its proprietary kernel filter driver. When an initial full image backup is performed, UrBackup creates a VSS (Volume Shadow Copy) snapshot of the C: drive, capturing a bit-for-bit image of the running operating system without locking open files.

For subsequent backups, the Change Block Tracking (CBT) driver tracks exactly which disk sectors were modified since the last backup:

• Initial Full Image: ~120GB written over 1GbE network in ~18 minutes.
• Daily Incremental Image: Only 1.5GB to 3GB of modified disk blocks transferred in under 90 seconds!
• Synthetic Full Assembly: UrBackup’s storage backend automatically links incremental blocks into synthetic full images, so every recovery point is a standalone, bootable VHD without requiring sequential replay.

4. Instant VHD Mounting: Plucking Files from Raw Disks

One of my favorite features in UrBackup is how it handles file extraction from bare-metal images. If you accidentally delete a config file or need to inspect an old registry hive, you don’t have to restore the entire 100GB image to a spare drive.

In the UrBackup Web UI, you simply click Mount Image on any historic restore point. The server exposes the image as a virtual drive or network share, allowing you to browse the filesystem tree and download individual files directly through your browser or mount the resulting .vhdx file in Hyper-V on HV2 for instant disaster testing.

5. Bare-Metal Recovery via iVentoy PXE

How do you restore a dead workstation with a brand-new blank NVMe drive? This is where our integrated infrastructure pays massive dividends:

1. Power on the target workstation and select UEFI Network Boot.
2. The workstation loads our central iVentoy PXE server (10.1.20.10).
3. Select UrBackup Restore Live CD (x64) from the graphical PXE menu.
4. The Live Linux environment boots into RAM, auto-detects the network, queries 10.1.20.18, and prompts for your authentication token.
5. Select the desired point-in-time image, target the blank disk, and click Restore.

In our live testing, restoring a complete 110GB Windows 11 Pro system drive took just 8 minutes and 42 seconds over 1GbE. The machine rebooted directly into Windows with all user profiles, desktop shortcuts, and installed drivers completely intact.

6. Production Takeaways

Having UrBackup running silently in Docker on docker02 gives us true enterprise-grade disaster recovery without commercial software licensing fees. Combined with multi-VLAN routing and iVentoy PXE booting, we can take any server or workstation from a smoking crater back to full production in under 15 minutes.