Replicating data over a public network

An apparatus comprising:

• at least one processor;
• and
• a memory that stores instructions that, when executed by the at least one processor, cause the at least one processor to:
• store in a proxy server credentials for authenticating a first storage node to use a secure communication channel, wherein the first storage node is associated with a replication partnership with a second storage node;
• establish port translations to be used in the secure communication channel to communicate replication data between the first storage node and the second storage node;
• and
• communicate replication partnership information to the second storage node.

A non-transitory storage medium storing instructions that, when executed by a machine, cause the machine to:

• provide an interface to receive input representing a credential associated with a first storage node and input representing criteria to select a replication partner storage node for the first storage node;
• access a proxy server for the replication partner storage node;
• communicate data representing the credential to the proxy server;
• and
• communicate with the proxy server to set up port forwarding for a future secure network tunnel to communicate replication data between the first storage node and the replication partner storage node, wherein the proxy server forms an endpoint of the secure network tunnel and the first storage node forms another endpoint of the secure network tunnel.