NAS and Offsite Backups: 3-2-1 Strategy, ZFS Snapshots, and Immutable Storage

Data loss from silent bitrot, hardware controller failure, accidental deletion, or ransomware attack is an existential threat to personal home labs and enterprise infrastructure alike. Establishing an automated, immutable backup topology guarantees that critical datasets can be restored rapidly and deterministically under catastrophic disaster scenarios.

This guide details the 3-2-1 Backup Strategy, ZFS block-level snapshot replication, encrypted pull-mode architectures, and immutable cloud object storage.

---

1. Quick-Reference: The 3-2-1-1-0 Backup Standard

+-----------------------------------------------------------------------------------------+
|                               THE MODERN 3-2-1-1-0 BACKUP RULE                          |
+-----------------------------------------------------------------------------------------+
| Standard               | Architectural Requirement         | Implementation Target      |
+------------------------+-----------------------------------+----------------------------+
| 3 Copies of Data       | Primary data + 2 backup copies    | Production + Local + Cloud |
| 2 Different Media      | Protect against medium failure    | NVMe SSDs + Magnetic HDDs  |
| 1 Off-site Copy        | Protect against physical disaster | Remote datacenter / Cloud  |
| 1 Immutable / Air-gap  | Protect against ransomware wipe   | S3 Object Lock (WORM)      |
| 0 Verification Errors  | Automated restoration testing     | Daily checksum validation  |
+-----------------------------------------------------------------------------------------+

---

2. Pull-Mode Security Architecture (Ransomware Immunity)

Traditional backup setups where the primary production server "pushes" backups to the NAS allow an attacker who compromises production to write or delete backup archives. In a Pull-Based Model:

• The backup server initiates an outbound SSH connection to read read-only ZFS snapshots from production.
• Production has zero SSH keys or network credentials for the backup NAS.

---

3. ZFS Snapshot Send/Receive Replication

# Automated Block-Level Incremental Replication
zfs snapshot tank/data@2026-08-15
zfs send -i tank/data@2026-08-14 tank/data@2026-08-15 |     ssh backup-nas "zfs receive -F backup-pool/tank-data"