Clonezilla Live 3.3.3: How reverse-connection simplifies disk cloning in corporate networks

MarGib September 26, 2026

🌐 🇵🇱 Polski · 🇬🇧 EN

Clonezilla Live 3.3.3 introduces the reverse-connection feature, a game-changer for network cloning. Learn how this mechanism works, what problems it solves, and how to configure it in practice – even behind restrictive firewalls.

Serwer w szafie rackowej z podłączonym kablem sieciowym do laptopa, ilustrujący mechanizm reverse-connection w Clonezilla. — Illustration of the reverse-connection mechanism in Clonezilla Live 3.3.3.

Why is reverse-connection a revolution in Clonezilla?

Disk cloning over the network is a daily routine in companies, schools, and laboratories. However, existing methods – unicast, multicast, or PXE – have serious limitations: they require opening ports on firewalls, struggle with NAT, and often fail in large networks. Clonezilla Live 3.3.3 introduces reverse-connection, a mechanism where the client initiates the connection to the server, rather than the other way around. This solution eliminates most network configuration issues while maintaining high performance and security.

How does this mechanism work in practice? In the traditional approach, the Clonezilla server had to connect to each client, which required opening ports (e.g., 22 for SSH) on the target machines. In the reverse-connection model, the roles are reversed: the client sends data to the server using the SSH or netcat protocol. Thanks to this:

You don't need to configure firewalls on the client side – it is enough that the server accepts incoming connections on the selected port.
It works behind NAT – ideal for machines in local networks without public IP addresses.
It reduces latency in bandwidth-constrained networks because data is sent directly to the server.

It is worth noting that reverse-connection does not replace multicast, but complements it – especially in scenarios where multicast fails (e.g., in networks with VLAN segmentation).

How to configure reverse-connection step by step?

Configuring reverse-connection in Clonezilla Live 3.3.3 is relatively simple, but requires a few steps on both the server and client side. Below is a detailed guide.

1. Preparing the server

On the machine that will act as the server, start Clonezilla Live and follow these steps:

Open the terminal and run the command:

sudo ocs-live-netcfg --reverse-connection --port 2222

The --port option allows you to choose any port (default is 2222).

Check if the firewall allows incoming connections on the selected port. On systems with ufw, run:

sudo ufw allow 2222/tcp

For other firewalls, adjust the rules accordingly.

Note the server's IP address – it will be needed for client configuration.

2. Starting the client

On the machine from which you want to clone the disk, follow these steps:

Start Clonezilla Live from a USB drive or PXE.
In the menu, select: device-image → network cloning → reverse connection.
Enter the server's IP address and port (e.g., 192.168.1.100:2222).
Choose the transfer protocol: SSH (recommended for security) or netcat (faster, but without encryption).
Select the source disk (e.g., /dev/sda) and start the cloning process.

Data will be sent directly to the server without the need to open ports on the client machine.

Limitations and notes

Number of clients: Official documentation does not specify a limit for simultaneous connections, but community tests indicate issues with more than 30 clients. In large networks, consider running multiple servers in parallel.
Performance: Using SSH may slow down the transfer compared to netcat, but it provides encryption. In trusted LAN networks, netcat may be a better choice.
Compatibility: Reverse-connection works only with Clonezilla Live 3.3.3 or newer. Older versions do not support this feature.

Reverse-connection vs. traditional methods: what to choose?

The choice between reverse-connection and traditional network cloning methods depends on the specifics of your environment. The table below compares key aspects:

Method	Pros	Cons	Best use case
Reverse-connection	No need to open ports on clients Works behind NAT Reduces latency in bandwidth-constrained networks	Requires server configuration Limited scalability with a large number of clients	Corporate networks, environments with restrictive firewalls
Unicast	Simple configuration Works in most networks	Requires opening ports on clients Does not work behind NAT without port forwarding	Small networks, one-off cloning
Multicast	Efficient for many clients simultaneously Reduces bandwidth usage	Requires router configuration (IGMP snooping) Often fails in networks with VLAN segmentation	Large networks, simultaneous cloning of many machines

Reverse-connection works best in environments where traditional methods fail – e.g., in corporate networks with restrictive security policies or in situations where client machines are behind NAT. Multicast remains a better choice for simultaneous cloning of many machines in a well-configured network.

Security of reverse-connection: what you need to know

Although reverse-connection eliminates many network configuration issues, it also introduces new security challenges. Here are the key aspects to keep in mind:

Encryption and authentication

SSH: By default, reverse-connection uses SSH (AES-256), which ensures data encryption in transit. This is the safest option, but it may slow down the transfer.
Netcat: An alternative to SSH, much faster, but does not encrypt data. Suitable only for trusted LAN networks.
Authentication: Clonezilla does not support SSH keys in reverse-connection mode – it uses passwords only. It is worth ensuring strong passwords and restricting access to the server using firewalls.

Potential threats

Brute-force attacks: A server with an open port (e.g., 2222) can be a target for attacks. Solution: Change the default port and restrict access to trusted IP addresses.
Man-in-the-middle: If you use netcat, an attacker can intercept data. Solution: Force the use of SSH or use netcat only in trusted networks.
Server overload: A large number of simultaneous connections can cause the server to crash. Solution: Monitor the load and limit the number of clients.

Best practices

Always use SSH if you are cloning data over untrusted networks.
Change the default port (e.g., from 2222 to 54321) and restrict server access to trusted IP addresses only.
Regularly update Clonezilla Live to benefit from the latest security patches.
Test the configuration in a test environment before deploying to production.

More information on Clonezilla security can be found in the official documentation.

Alternatives to Clonezilla: what to choose?

Clonezilla is a powerful tool, but not the only one on the market. Here are some alternatives worth considering depending on your needs:

1. FOG Project

Type: Open-source
Reverse-connection: No
Pros: Machine management, PXE and multicast support, extensive web interface.
Cons: Complex installation, requires a dedicated server.
Best use case: Large networks where fleet management is needed.

FOG Project is a great alternative to Clonezilla if you need a tool to manage multiple machines simultaneously. Unfortunately, it does not support reverse-connection, which can be an issue in networks with restrictive firewalls. You can read more about FOG Project on the project wiki.

2. Acronis Snap Deploy

Type: Commercial
Reverse-connection: Yes (since version 6.0)
Pros: Speed, technical support, cloud integration.
Cons: High license cost, closed source.
Best use case: Companies that need support and ready-made solutions.

Acronis Snap Deploy has offered reverse-connection since version 6.0, making it a direct competitor to Clonezilla. However, it is a paid solution, which may be a barrier for small businesses or individual users. More information can be found on the official website.

3. Veeam Agent

Type: Commercial
Reverse-connection: No
Pros: Cloud integration, backup and data recovery.
Cons: No network cloning, focus on backup.
Best use case: Environments where backup is the priority, not cloning.

Veeam Agent is a tool focused on backup and data recovery, not disk cloning. It does not support reverse-connection or network cloning, but it can be useful in environments where backup is a priority.

4. Partclone

Type: Open-source
Reverse-connection: No
Pros: Lightweight, base for Clonezilla, support for many file systems.
Cons: No graphical interface, requires manual configuration.
Best use case: Advanced users who need a tool for custom scenarios.

Partclone is the tool that Clonezilla is based on. It is lighter and more flexible, but requires manual configuration and does not offer a graphical interface. It does not support reverse-connection, but can be useful in custom cloning scenarios.

What does the future hold? Clonezilla development plans for 2026

Clonezilla is an actively developed project, and reverse-connection is just one of many new features coming in the next few months. Here is what we can expect:

1. IPv6 support

Currently, reverse-connection works only with IPv4, but the developers have announced support for IPv6 in 2026. This is an important change, especially in the context of IPv4 address exhaustion and the growing popularity of IPv6 in corporate networks.

2. Cloud integration

Experimental support for AWS S3 and Backblaze B2 appeared in version 3.3.5-alpha. In the future, we can expect full cloud integration, which will allow storing disk images directly in services like Amazon S3 or Google Cloud Storage.

3. Graphical interface improvements

Currently, reverse-connection is only available via CLI. However, the developers have announced improvements to the graphical interface that will make configuring this feature easier for less advanced users.

4. ZFS and Btrfs support

Version 3.4.0, planned for December 2026, is set to introduce full support for ZFS and Btrfs file systems. Currently, Clonezilla supports these systems only in experimental mode, which may cause errors when restoring data.

Update schedule

August 2026: Version 3.3.4 – bug fixes and multicast optimization.
December 2026: Version 3.4.0 – ZFS support, Btrfs improvements, and cloud integration.

More information on Clonezilla development plans can be found in the official roadmap.

Summary: Is reverse-connection the future of network cloning?

Clonezilla Live 3.3.3 with the reverse-connection feature is a significant step forward in the field of disk cloning over the network. This mechanism solves many problems that have hindered administrators until now – from restrictive firewalls to NAT. Although it is not without flaws (e.g., limited scalability), it is a valuable alternative to traditional methods, especially in corporate environments.

If you manage a network with many machines behind NAT or restrictive security policies, reverse-connection can prove to be an invaluable tool. However, it is worth remembering that Clonezilla is not the only solution on the market – tools like FOG Project or Acronis Snap Deploy offer a different approach to network cloning and may work better in specific scenarios.

Regardless of the tool chosen, it is crucial to understand its capabilities and limitations. Reverse-connection in Clonezilla is a step in the right direction, but the future of network cloning depends on the further development of technology – especially in the context of IPv6 and cloud integration.

If you want to learn more about Linux server automation, we invite you to read our guide on Bash scripts.