SOLVED Firewall slowing down UI or even causing the UI to freeze

[terrencetec]

Hi everyone,

I am new to TrueNAS and I have recently built a TrueNAS system with the following hardware (probably not related but I will post anyway.

• CPU: Intel Xeon E-2146G
• Motherboard: Gigabyte C246N-WU2
• RAM: 32GB 2Rx8 PC4-2666V-EE1-11 HMAA4GU7AJR8N-VK TO AC 2120

I ran one RAIDZ2 pool with 5 WD 8TB RED PLUS WD80EFZZ.

My ultimate goal is to have safe remote access to my data. I know remote access is generally not recommended but I will be moving to another country in a few months so I really hope to have remote access to my data.
I went the OpenVPN + firewall route. I followed this guide: https://www.youtube.com/watch?v=YEkfW4aC9Rk
and configured OpenVPN Certificates for the server and clients, and set up the OpenVPN server.
I follow the video to set up tunables including

Code:

firewall_enable 1
firewall_type open
gateway_enable 1
natd_enable 1
natd_interface igb0
natd_flags -dynamic -m

After restarting, VPN worked fine and I can access my SMB share remotely.
However, I accessed the TrueNAS UI (both remotely and locally) and sometimes it would freeze and there's no way to continue using the UI.
If I type the TrueNAS IP on a new browser tab, it would show the UI background color but it would take forever to load the login screen.
There's a crazy font problem as well when this happens. I didn't take a screenshot (I will later if I am brave enough to enable the firewall again).
Sometimes it is still accessible so I took the chance to disable firewall_enable and firewall_type.
After that, the UI returns to normal.

I have a few questions.
Have anyone encountered this? Does anyone know how to fix this problem?
Is there a way for me to modify the firewall tunables using CLI? I can modify it using SSH (I have set up the SSH keys for SSH access) when I can't access the UI.
Is it safe to leave firewall_enable and firewall_type disable if I really want remote access?
What are other better ways?
Thanks.

P.S. I am a complete newbie when it comes to networking.

 

[Samuel Tai]

You're likely experiencing a NAT hairpin when you run into these problems. It's not recommended to enable the TrueNAS firewall at all. I think you should remove these tunables, and unconfigure OpenVPN. Leave the remote access VPN to a separate device, which can be debugged separately from TrueNAS.

In my case, I enabled WireGuard on my OpenWRT router for remote access to TrueNAS, which works extremely well. WireGuard is also much faster than OpenVPN, and has been more thoroughly peer-reviewed for crypto weaknesses by crypto experts.

On the remote clients, I then run WireGuard and a SMB client. WireGuard makes the remote experience about 80% the speed of the LAN experience.

Feel free to PM me here about the details of my setup.

 

[terrencetec]

You're likely experiencing a NAT hairpin when you run into these problems. It's not recommended to enable the TrueNAS firewall at all. I think you should remove these tunables, and unconfigure OpenVPN. Leave the remote access VPN to a separate device, which can be debugged separately from TrueNAS.

In my case, I enabled WireGuard on my OpenWRT router for remote access to TrueNAS, which works extremely well. WireGuard is also much faster than OpenVPN, and has been more thoroughly peer-reviewed for crypto weaknesses by crypto experts.

On the remote clients, I then run WireGuard and a SMB client. WireGuard makes the remote experience about 80% the speed of the LAN experience.

Feel free to PM me here about the details of my setup.

Thank you for the prompt response. I really appreciate it.

I think it makes a lot of sense to configure the VPN on another device. Again, I am very ignorant when it comes to networking stuff...

I have taken a cursory look at my router configurations and I don't think there's an option to enable WireGuard.
I am using a NETGEAR Orbi and I don't think it's easy to change to another one since it's shared with my family. I am quite embarrassed already because I have been making a mess. Luckily nothing breaks.

In this case, what would you further recommend? Thanks.

 

[Samuel Tai]

Orbi has OpenVPN already built-in, under Advanced > Advanced Setup> VPN Service.

How do I enable the VPN service on my Orbi WiFi System using an Android or iOS device?

How do I use VPN on my Orbi system with my iOS device?

kb.netgear.com

 

[terrencetec]

Yes. Thank you very much. I have enabled OpenVPN from the router. It took me a while to figure it out but eventually, it works on all devices, Windows, Linux, IPhone, and Android! Thank you very much for your help!