PBS: decryption failed or bad record mac

During sync between two Proxmox Backup Server instances I got “decryption failed or bad record mac” error message. So I decided to go for upgrading source PBS to match its version with target PBS.

PBS upgrade #

To upgrade PBS:

Bash
apt update
apt dist-upgrade
tar czf "pbs3-etc-backup-$(date -I).tar.gz" -C "/etc" "proxmox-backup"
pbs3to4
proxmox-backup-manager versions
sed -i 's/bookworm/trixie/g' /etc/apt/sources.list
cat > /etc/apt/sources.list.d/proxmox.sources << EOF
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF

Get rid of bookworm sources. And then:

Bash
apt update
apt dist-upgrade
systemctl reboot

However it did not help.

Further debugging #

3 things involved in this investigation.

This one:

Text
ethtool -K eth0 tso off gro off gso off ufo off

Next disabling Suricata IDS/ISP. Did not help.

Finally I changed pfSense settings for System – Advanced – Firewall & NAT from Aggressive to Conservative:

It worked.

View as Markdown

All the content on this website is licensed under Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0). Cite as: Michał Sobczak, “PBS: decryption failed or bad record mac”, 27 September 2025, https://michalasobczak.pl/posts/pbs-decryption-failed-or-bad-record-mac.html