A Synology ActiveProtect DP320 costs about $2,040 for 8 TB of mirrored backup space. A Proxmox Backup Server box built on a UGREEN DXP4800 Plus with two 10 TB drives costs about $1,580 for 10 TB. On hardware the DIY box wins by about $100 per usable terabyte. The decision turns on two other lines. One is what the appliance backs up that PBS cannot; the other is the €1,120 a year Proxmox charges for its cheapest subscription with support tickets.
This ActiveProtect vs Proxmox Backup Server comparison prices both routes over five years and maps the ActiveProtect workload list against what PBS actually protects. It also reports measured results from a PBS lab box: incremental backup sizes, deduplication, protected snapshots, encryption overhead and restore times. Proxmox Backup Server 4.2.8 (tested October 2026 on Debian 13) installed in 80 seconds and backed up 1.13 GiB of mixed files in 4.8 s. ActiveProtect was not run in the lab, so every appliance figure below comes from Synology datasheets and live listings.
Which one to buy
What you back up decides this far more than the hardware does. If every workload is a Proxmox VE guest or a Linux host, PBS covers it and the appliance price buys nothing extra. If the list includes Windows PCs, VMware, Hyper-V or Microsoft 365, ActiveProtect covers those from one console and PBS does not:
- Proxmox-only homelab or small business: build the box. A UGREEN DXP4800 Plus with two WD Red Plus 10TB drives runs PBS with room for two more drives, for about $1,580 at current prices.
- Mixed office with Windows PCs, file servers and Microsoft 365: the Synology ActiveProtect DP320 (around $2,040, check the live price). It protects up to 10 servers and ships with the drives installed.
- Mixed estate past 5 TB of source data or on 10GbE: the Synology ActiveProtect DP340 (around $4,600 from third-party sellers, check the live price), with 24 TB after RAID 5 and a 10GbE data port.
Both Amazon listings for the appliances were third-party sellers on 28 October 2026, and the DP340 listing showed two units left. Synology resellers are the other route, so compare before you pay a marketplace premium.
1. ActiveProtect vs Proxmox Backup Server side by side
The two products overlap on Proxmox VE and Linux, and diverge everywhere else. Synology added Proxmox VE to ActiveProtect Manager 2.0 in September 2026, so a Proxmox cluster can now back up to either one. There is a catch: Synology’s APM 2.0 spec supports Proxmox VE 8.x and 9.x for QEMU/KVM VMs only, so LXC containers stay unprotected on the appliance. PBS stays a Proxmox-first product: its own client covers Linux hosts, and its docs list no VMware, Hyper-V or Windows host agent. The table holds the rows that change a purchase:
| Item | Synology ActiveProtect (DP320 / DP340) | Proxmox Backup Server (DIY box) |
|---|---|---|
| What you buy | Appliance with drives installed, ActiveProtect Manager OS | Free software on any x86 box you choose; Debian 13 base |
| Workloads | Windows, macOS, Linux, VMware vSphere, Hyper-V, Nutanix AHV, Proxmox VE (VMs only, no LXC), NetApp ONTAP, Synology NAS, Microsoft 365, Google Workspace, SQL Server, Oracle DB, Azure VM, Amazon EC2 | Proxmox VE VMs and containers (any guest OS), Linux hosts via proxmox-backup-client |
| Scale per box | DP320: 10 servers, 500 workloads. DP340: 30 servers, 1,500 workloads | No software limit; bounded by disks, RAM and CPU |
| Licensing | Up to 3 backup servers per site without a licence; more needs a term licence pack | All features free; support subscription optional, per server per year |
| Lowest tier with support tickets | Synology support during the 3-year hardware warranty | Basic: €1,120 per server per year, 5 tickets |
| Immutability | Immutable (WORM) backups listed as a feature | Protected snapshot flag; admins can clear it |
| Encryption | Volume-level encryption listed | Client-side AES-256-GCM, key never leaves the client |
| Offsite copy | ActiveProtect Vault on a Synology NAS, air-gap option | Sync jobs (pull or push) to another PBS, S3 backend, LTO tape |
| Internet dependency | Licence check; 14 days without internet blocks new backups for the whole site | None; the enterprise repository needs a key, the no-subscription one does not |
Two rows deserve a second read. The licence row is generous for a single site: one DP320, or up to three appliances, run with no licence fee. The internet row cuts the other way. Every appliance ships with a default licence, ActiveProtect Manager checks it online, and a site with no internet for 14 days stops creating new backups, even a single DP320 inside the free tier. A PBS box keeps working offline indefinitely, which matters for air-gapped or remote sites.
2. Five-year cost per usable terabyte
Per usable terabyte, the DIY box costs between half and five sixths of an appliance before any subscription. Prices below are Amazon prices read through the retailer API on 28 October 2026, rounded, and they move, so treat them as a band. Usable capacity is after RAID or mirroring, before deduplication:
| Build | Hardware (approx.) | Usable | Per usable TB | 5 years with the lowest ticketed support |
|---|---|---|---|---|
| ActiveProtect DP320 (2 x 8 TB, RAID 1) | about $2,040 | 8 TB | about $255 | about $2,040 (3-year warranty, years 4 and 5 uncovered) |
| ActiveProtect DP340 (4 x 8 TB RAID 5, 2 x 400 GB SSD) | about $4,600 | 24 TB | about $190 | about $4,600 (3-year warranty, years 4 and 5 uncovered) |
| DXP4800 Plus + 2 x WD Red Plus 10TB (mirror) | about $1,580 | 10 TB | about $160 | about $1,580 + €5,600 PBS Basic |
| DXP4800 Plus + 4 x WD Red Plus 10TB (two mirrors) | about $2,500 | 20 TB | about $125 | about $2,500 + €5,600 PBS Basic |
Without a subscription, the four-drive DIY build stores 20 TB for about $2,500, which is roughly half the DP340 price for 4 TB less space. Add PBS Basic for five years and the picture flips: €5,600 of support is more than either appliance costs outright. The columns are not a perfect match, since a hardware warranty is not a ticketed support contract and it ends after year three, but whether you need a vendor to call still decides the result. Proxmox also sells a Community tier at €560 per server per year, with enterprise repository access and no tickets. A homelab or a team that already runs Proxmox VE without a subscription loses nothing by skipping it, because every PBS feature works on the free no-subscription repository.
Two costs hide in the DIY column. The PBS system requirements ask for 4 GiB of RAM plus 1 GiB per TiB of datastore. That puts a 10 TB box near 13 GiB and a 20 TB box near 22 GiB, and the DXP4800 Plus ships with 8 GB. Budget a DDR5 SO-DIMM upgrade (it takes up to 64 GB). The same docs recommend an SSD mirror as a ZFS special device when the datastore sits on hard drives, and the box has two M.2 slots for exactly that. The PBS box build guide sizes both with measured numbers.
3. How the PBS box was tested
We measured the PBS side on a lab VM and could not measure the ActiveProtect side, because no appliance was available. We installed PBS from the no-subscription repository, created an ext4 datastore on a separate virtual disk and backed up a copy of a real filesystem with proxmox-backup-client. The test box was deliberately below the PBS recommendation of four cores, to show the floor rather than a sized build:
- Host: Debian 13 VM
bench01, 2 vCPU, 4 GiB RAM, virtual disks on the hypervisor’s ZFS pool, so the throughput figures are best case and not a hard drive number. - Data set: 1.2 GiB in 24,678 files, a copy of
/usr/shareand/usr/libplus a 512 MiB random file that cannot compress. - Client: proxmox-backup-client on the same box over localhost, so network speed is not part of any result. The shell exported
PBS_REPOSITORY=klinsmann@pbs@localhost:store1and the user’s password, which is why the commands below carry no--repositoryflag.
Installing PBS took 1 minute 20 seconds, pulled 59 new packages and added 359 MB to the root disk. The two daemons idled at 26 MB and 30 MB of resident memory. The PBS install walkthrough covers the repository and package steps, so they are not repeated here.
4. Incremental backups: 128 MiB moved for a 5% change
A second backup of the same host uploaded 128 MiB out of 1.19 GiB, and the third uploaded nothing. Between run 1 and run 2 we added a 64 MiB random file and appended one line to 300 text files. The command was identical for all three runs:
proxmox-backup-client backup data.pxar:/srv/data --backup-id bench01-filesRun 2 downloaded the previous manifest, then reused 89.5% of the chunks already on the server:
Starting backup: host/bench01-files/2026-10-28T02:22:37Z
Client name: bench01
Starting backup protocol: Wed Oct 28 02:22:37 2026
Downloading previous manifest (Wed Oct 28 02:22:27 2026)
Upload directory '/srv/data' to 'klinsmann@pbs@localhost:8007:store1' as data.pxar.didx
data.pxar: had to backup 128.192 MiB of 1.192 GiB (compressed 99.049 MiB) in 2.23 s (average 57.466 MiB/s)
data.pxar: backup was done incrementally, reused 1.067 GiB (89.5%)
Uploaded backup catalog (644.354 KiB)
Duration: 2.41s
End Time: Wed Oct 28 02:22:40 2026Side by side, the three runs read like this:
| Run | Source | Uploaded | Compressed | Reused | Duration |
|---|---|---|---|---|---|
| 1 (first full) | 1.13 GiB | 1.128 GiB | 784.973 MiB | 0.1% | 4.84 s |
| 2 (about 5% changed) | 1.192 GiB | 128.192 MiB | 99.049 MiB | 89.5% | 2.41 s |
| 3 (no change) | 1.192 GiB | 0 B | 0 B | 100% | 1.95 s |
Run 2 uploaded about twice the bytes that actually changed. PBS splits a file-level archive into variable-size chunks (2.47 MiB on average in this datastore), so an appended line rewrites the whole chunk around it. The 64 MiB blob explains half of the upload; the 300 one-line edits dirtied the other 64 MiB, roughly two dozen chunks, because neighbouring files share chunks. Plan retention on the uploaded figure, not on the bytes your users changed. The no-change run still took 1.95 s because, in the default change-detection mode, the client reads every file to hash it. On a host with millions of files that read, not the upload, sets the backup window. The --change-detection-mode metadata option (PBS 3.3 and later) skips unchanged files by their metadata and is the setting to test on a large file server.
After a garbage collection pass the datastore held 3.52 GiB of logical backups in 884 MiB of chunks, a deduplication factor of about 4.07 across the three snapshots. The datastore summary later showed 2.78, once the encrypted backup from section 6 had added its own chunks:
Synology also lists source-side and server-side deduplication for ActiveProtect, so both routes stretch raw capacity. What we cannot give is a like-for-like ratio for the appliance, because that needs one on the bench.
5. Protected snapshots and what a stolen credential can delete
A client credential with the DatastoreBackup role cannot delete or prune snapshots, but it can remove the protection flag. That is the result that matters for ransomware, because the credential most likely to leak is the one sitting on every backed-up host. We protected the newest snapshot as the backup user first:
proxmox-backup-client snapshot protected update host/bench01-files/2026-10-28T02:22:44Z trueExit code was 0. Then the same user tried to forget that snapshot:
proxmox-backup-client snapshot forget host/bench01-files/2026-10-28T02:22:44ZPBS refused on permissions, and a prune attempt returned the same line:
Error: permission check failed - missing Datastore.Modify|Datastore.Prune on /datastore/store1Next, the same user ran snapshot protected update ... false and it succeeded, so the flag is not a lock against the account that set it. We re-protected the snapshot and raised the user to DatastoreAdmin. A forget on the protected snapshot now failed for a different reason:
Error: failed to delete snapshot - cannot remove protected snapshotA prune with --keep-last 1 removed the oldest snapshot and kept both of the others, the protected one plus the newest unprotected one. Protected snapshots did not count toward the keep-last budget in this run. The content view marks them with a green shield:
Read the result as two layers. Role separation stops a compromised client from deleting history, which is the common attack. The protected flag stops an admin from deleting by accident, but an admin, or root on the PBS host, can clear it. That is weaker than a WORM retention lock. Synology lists immutable WORM backups for ActiveProtect; we could not test how its lock behaves against an admin without hardware. On PBS, the stronger answer is a second copy the first box cannot reach: a pull sync job to another PBS, tape, or the object-lock immutable backup setup on separate storage.
6. Client-side encryption doubles the datastore
An encrypted backup of the same 1.19 GiB data set reused 0.1% of the existing chunks, so the datastore grew from 358 chunks to 702. Encrypted chunks are keyed to the encryption key, which means they never match chunks written in plain text or under another key. We created a key and backed up the unchanged directory under a new backup ID:
proxmox-backup-client key create /home/klinsmann/bench01.key --kdf none
proxmox-backup-client backup data.pxar:/srv/data --backup-id bench01-enc --keyfile /home/klinsmann/bench01.keyThe client confirms the key, then uploads almost the whole archive again:
Using encryption key from '/home/klinsmann/bench01.key'..
Encrypting backup with key fingerprint <redacted>
No previous manifest available.
Upload directory '/srv/data' to 'klinsmann@pbs@localhost:8007:store1' as data.pxar.didx
data.pxar: had to backup 1.191 GiB of 1.192 GiB (compressed 849.016 MiB) in 4.72 s (average 258.351 MiB/s)
data.pxar: backup was done incrementally, reused 1.374 MiB (0.1%)
Uploaded backup catalog (644.354 KiB)
Duration: 11.07sOn-disk chunk data went from 927 MB to 1.82 GB. Total duration was 11.07 s against 4.84 s for the plain first run, although the upload phase alone took 4.72 s against 4.48 s. The practical rule: decide on encryption before the first backup and use one key per group of hosts that should deduplicate together. Switching later doubles the datastore for as long as the old plain snapshots stay in retention. Keep a copy of the key off the PBS box, since a lost key makes those snapshots unreadable. The lab used --kdf none, which stores the key with no passphrase; on a real host, let it prompt for one or protect the file another way.
7. Restore, verify and the CPU benchmark
A full restore of the 1.19 GiB snapshot took 3.8 s at 324.8 MiB/s, and diff -rq against the source printed zero differences. A single-directory restore with --pattern pulled only the requested docs in 3.6 s, because the client still reads the whole 1.19 GiB archive to find them. A full datastore verify finished in 2.0 s with 0 errors. These are small-data numbers on virtual disks; on hard drives, verify speed drops to what the spindles deliver, which is why the docs push SSDs or a special device.
PBS ships a benchmark that shows where the CPU ceiling sits on a 2 vCPU slice:
proxmox-backup-client benchmark --repository klinsmann@pbs@localhost:store1Percentages compare against the Proxmox reference machine:
┌───────────────────────────────────┬─────────────────────┐
│ Name │ Value │
╞═══════════════════════════════════╪═════════════════════╡
│ TLS (maximal backup upload speed) │ 1367.21 MB/s (111%) │
├───────────────────────────────────┼─────────────────────┤
│ SHA256 checksum computation speed │ 1786.73 MB/s (88%) │
├───────────────────────────────────┼─────────────────────┤
│ ZStd level 1 compression speed │ 514.54 MB/s (68%) │
├───────────────────────────────────┼─────────────────────┤
│ ZStd level 1 decompression speed │ 927.93 MB/s (77%) │
├───────────────────────────────────┼─────────────────────┤
│ Chunk verification speed │ 607.98 MB/s (80%) │
├───────────────────────────────────┼─────────────────────┤
│ AES256 GCM encryption speed │ 8861.30 MB/s (243%) │
└───────────────────────────────────┴─────────────────────┘Compression at 514 MB/s is the lowest line and still about four times what a 1GbE link carries (roughly 118 MB/s). On a DP320-class network the wire is the limit for PBS too. CPU only starts to matter at 10GbE, where the Pentium Gold in the DXP4800 Plus or the Core i9 in the MS-01 earn their place over a two-core appliance chip.
Synology ActiveProtect DP320: the small-office appliance
The DP320 is the right buy for an office that needs one backup console for PCs, servers and SaaS and has nobody to maintain a Linux box. It arrives with two 8 TB drives in RAID 1 and the ActiveProtect Manager OS installed:
Synology rates it for 10 servers or 500 workloads and suggests about 5 TB of source data. The spec lines that decide fit are short:
- CPU and RAM: AMD Ryzen R1600, 2 cores, 8 GB.
- Network: one 1GbE data port plus one 1GbE management port, so about 118 MB/s is the ceiling for a restore.
- Power and warranty: 21 W in access, 3-year warranty.
Skip it if your estate is Proxmox-only, since you would pay about $2,040 for 8 TB that a $1,580 DIY box beats on capacity. The 1GbE port also stretches a full restore of 5 TB to about 12 hours at line rate. Growing in place is not an option either, because two bays are all the chassis has. The DP320 listing on Amazon was around $2,040 from a third-party seller on 28 October 2026; check the live price.
Synology ActiveProtect DP340: 10GbE and 24 TB
The DP340 fixes the two DP320 limits that matter most, capacity and the 1GbE port. It ships with four 8 TB drives in RAID 5 for 24 TB, two 400 GB M.2 SSDs in RAID 1, 16 GB of RAM and a 10GbE data port:
Synology’s rating is 30 servers or 1,500 workloads, at 35.5 W in access. The CPU is the same two-core R1600 as the DP320, so the extra money buys disks, RAM, SSDs and the network port rather than compute. With the 10GbE port, the 5 TB restore that takes 12 hours on a DP320 becomes a disk-bound job instead of a wire-bound one.
Skip it if you only need Proxmox VE coverage, because about $4,600 buys nearly two four-drive DIY PBS boxes. Skip it as well if you cannot wait for stock: the DP340 on Amazon showed two units from a third-party seller on 28 October 2026, so check the live price and a Synology reseller quote before buying.
Build the box: DXP4800 Plus with WD Red Plus
For a Proxmox VE estate, a four-bay x86 box with CMR drives is the build we would run. The UGREEN DXP4800 Plus is diskless, accepts third-party drives and has a 10GbE port, a 2.5GbE port and two M.2 slots for the SSD metadata mirror:
It ships with UGOS, and for this build you install PBS from its ISO in place of it. UGOS lives on a single built-in 128 GB SSD, and the PBS docs recommend redundant OS storage, Both M.2 slots already hold the metadata mirror. That leaves two realistic choices: accept the single OS SSD and keep a config backup, or give two of the four bays to an OS mirror, which halves the 20 TB layout. The 8 GB of RAM is under the PBS sizing rule for any datastore past about 4 TiB, so add memory at build time. It was about $660 on Amazon on 28 October 2026, with a 2-year warranty against the 3 years on a Synology appliance. Skip it if a two-year warranty or the RAM upgrade puts you off; the DXP4800 Plus listing shows the live price.
Fill it with CMR drives. The WD Red Plus 10TB (WD100EFGX) is CMR, rated for 180 TB per year of workload and carries a 3-year warranty:
Two drives in a mirror give 10 TB. Four drives as two mirrors give 20 TB and twice the random I/O, which helps garbage collection and verify on spinning disks. The WD Red Plus 10TB was about $460 each, sold by Amazon, on 28 October 2026. Skip it if price per terabyte matters more than the mirror layout; larger drives cost less per TB, and the NAS hard drive comparison ranks them.
If your datastore fits on NVMe, the Minisforum MS-01 is the all-flash route the PBS docs prefer. It has three M.2 slots, two 10G SFP+ ports and two 2.5GbE ports, but no 3.5-inch bays:
An MS-01 with a Core i9-13900H, 32 GB and 1 TB was about $1,280 on 28 October 2026, before the datastore SSDs. It stops making sense past a few terabytes, since enterprise NVMe with power-loss protection costs more per TB than the whole hard drive build. The Synology alternatives roundup covers other four-bay boxes if UGREEN is not your brand.
Pick by what you back up
Start from the workload list, then the support requirement, then capacity. Price comes last because it only separates options that already fit:
- Only Proxmox VE guests and Linux hosts, no support contract needed: the DIY PBS box. Lowest cost per terabyte, no licence checks, and every feature on the free repository.
- Only Proxmox VE, but policy demands vendor support: compare a DP320 or DP340 against €1,120 per year for PBS Basic. Over three years or more the appliance costs less, provided your guests are VMs: ActiveProtect does not back up LXC containers, so a container-heavy cluster stays on PBS.
- Windows PCs, VMware, Hyper-V or Microsoft 365 in the mix: ActiveProtect, DP320 under 5 TB of source data, DP340 above it or on 10GbE.
- Remote or offline site: PBS, because it runs without reaching a vendor server.
Whichever box you pick, it is one copy. Pair it with an offsite target before you count the job done: a second PBS pulling over a sync job, an ActiveProtect Vault on another Synology, or object storage with a lock. A Proxmox estate that still runs vzdump to local disk gains more from either box than from any spec line in this comparison.
