MOD - DO NOT USE THIS GUIDE - How to Set Up TrueNAS From Beginning to End - including secure remote access to files and Web GUI

[yellowbananabus]

This tutorial will go over all the basics in detail for a complete beginner that you will have to complete to set up a NAS on a dedicated machine you can access from both from a local and remote network securely, while also having the ability to SSH into the NAS securely remotely, allowing remote access to your NAS shell and the web GUI. To set up the NAS on a VM, simply follow these instructions, utilizing a VM. Note all the bolded text, these are important. Please keep in mind I recently got into this and am in no way a professional, however, doing the following has worked error-free for me.

Also quick comment regarding pasting code in shell/SSH (Putty). For the shell, to paste use CTRL+V. For the Putty just right click.

Required Materials

• 1 USB (1 GB min.)
• 2 separate hard drives or SSDs
• A dedicated computer to run the NAS from
• A router that allows port forwarding (most routers allow this)

Example IP addresses

• TrueNAS machine: 192.168.0.10
• Nextcloud Instance: 192.168.0.20
• Router Config Page: 192.168.0.1
• DDNS: example.duckdns.org

Instructions

• To proceed, keep in mind you need both an install drive and a boot drive, separate from each other. The following will be about how to set up the install drive.
  • Begin by downloading the ISO image of TrueNAS and Rufus - just google the links to these.
  • Using Rufus, mount the ISO image to your drive of choice. Note - you can just use a USB for this step (must be at least 1 GB)
    • You can keep all the settings at the default on Rufus.
  • After it has finished mounting, go into the BIOS of your future NAS machine.
    • Make sure that the boot order has the UEFI USB as the top priority, and uncheck secure boot (it will not boot if this isn't done).
• The following is about how to set up the boot drive.
  • Now plug in your USB drive into your future NAS machine and boot it up.
    • The program will automatically start.
  • From the settings page select the drive you desire to make your boot drive.
    • Note - though many tutorials state that it can be a USB drive, this has not worked for me AT ALL. Using a dedicated hard drive, external or internal is your best bet (keep in mind this will FORMAT ALL DATA on your hard drive).
  • In the settings, it will ask if the device should install in UEFI or Legacy mode. UEFI should work for all modern drives.
  • Create a root password.
  • Now allow the program to install the boot media onto the hard drive.
  • Once the installation is complete, you can power down your machine, unplug the USB, and keep the hard drive plugged in. PLUG IN AN ETHERNET CABLE (WiFi does not work on TrueNAS). Also plug in a separate hard drive (this will come in handy later).
  • Start up your machine again.
    • If you did everything correctly, the machine should automatically boot into the TrueNAS OS and begin installing more necessary files (this will take a while so just grab a cup of coffee).
• The following is how to configure your settings on TrueNAS.
  • After everything is installed, the shell will give you a few options that look like the following
  • 
    
    
  • Everything should technically be ready to go, so type in one of the two IP addresses you see below on a web browser on a different computer that is connected to your local internet. I.e. 192.168.0.10
    • The WebGUI should pop up looking like the following.
      • 
        
        
      • If you don't see this, then refer to the below.
        • In your TrueNAS machine, type 1 and press enter to get into the network configuration.
        • Here type in the number of your network interface from the options, should usually be 1.
        • Then when it asks whether you want to reset the network configuration, type y for yes and press enter.
        • Note - though you can type 1 and press enter again to change the IP address of your TrueNAS machine, I found it always eventually changed back to its default IP address, so to lessen confusion, I advise against this.
  • The default username is root, the password should be the root password you set up in the installation of the TrueNAS boot media.
    • Now you should see the web GUI, it should look like this
    • 
      
      
  • To create shared volumes you can access through connection to your local network, see the following instructions.
    • Go to accounts on the left panel.
      • Click on groups.
        • Click add.
          • Enter a group name (you can leave the GID as it is).
          • Enable permit sudo and samba authentication.
          • Submit.
    • Go to accounts on the left panel.
      • Click on users.
        • Click add.
          • Fill in all the empty field under Identification
          • Uncheck new primary group.
          • Choose the group you made previously from the drop down menu in primary groups.
          • Go ahead and check all of the boxes under Home Directory Permissions.
          • Under Authentication check permit sudo and Samba authentication.
          • Submit.
    • Go to Storage -> Disks on the left panel.
      • Find the name of the disk you desire to use as your NAS shared disk.
        • Note - the shared disk CANNOT be the same disk you have your boot media on. Use the different drive you plugged in previously.
      • Go to Storage -> Pools
        • Click add.
          • Select create new pool then click create pool.
      • Go back to Storage -> Pools
        • You should see the name of your new pool pop up.
        • Click on the three dots on the right side of that name.
          • Click add Zvol (this must be done!)
            • Put in a name and select a size for the Zvol (for a 1TB drive I used 1 GB, this is block device mainly used for VMs, so you can use less if you don't plan on using VMs on your NAS, more if you do).
            • Click submit.
        • Click on the three dots on the right side of the pool once again.
          • Click add dataset.
            • Type in a name and click submit.
        • Now you should be able to see the name of that dataset underneath your pool in Storage -> Pools
        • Click on the three dots on the right side of the name of the dataset.
          • Click on permissions.
            • Set the user under owner to www and group to www.
            • Click apply user and apply group.
            • Under access mode, check all of the boxes.
            • Click apply permissions recursively under advanced.
            • Click save.
        • Click on the three dots on the right side of the name of the dataset.
          • Click on permissions.
            • Click on ACL manager.
            • Click on the preset open under the dropdown menu.
            • Set the user under owner to www and group to www.
            • Click apply user and apply group.
            • Click apply permissions recursively under advanced.
            • Click save
    • Go to Services
      • Enable SMB and click on start automatically.
    • Go to Sharing -> Windows Shares (SMB)
      • Click add.
        • Select the path to your dataset.
        • Click submit.
    • Now to access this folder from your Windows machine on your local network.
      • Go to file explorer -> network
      • Click on the top field and enter the IP address of your TrueNAS machine in this fashion (should be the same as the IP address you used to connect to your WebGUI)
        • \\youripaddress
      • When it asks for username and password, use the username of the new account you created in the WebGUI and its password.
      • If you see your folder, great! If not, refer back to the previous steps to see if you did anything wrong.
• The following is how to set up remote access to your shared folder.
  • The first thing you have to do is go to duckdns.org (this is a DDNS service that allows a static address to your constantly changing IP address to your local network externally).
    • Sign in.
    • Create a domain.
  • Go back to you TrueNAS WebGUI
    • Go to Tasks -> Cron Jobs
      • Click add
        • Enter DuckDNS as the description
        • Under command, enter the following
          • /usr/local/bin/curl "https://www.duckdns.org/update?domains=yoursubdomain&token=yourtoken&ip="
            • To find your subdomain and your token, on DuckDNS.org, your subdomain is the first part before .duckdns.org, and your token should be shown near the top panel of the page. Replace the bolded text with this information.
        • Under schedule, enter how often you want this to run (I selected hourly)
          • This is how often it will update your IP address to coincide with your DDNS domain.
        • Click save.
    • Go to Plugins
      • Note - This tutorial will use Nextcloud for remote access to files as I could not get OpenVPN to work for the life of me. This is a great alternative that offers many options for the user easily.
      • Click on Nextcloud.
        • Click install.
        • Under plugin name, enter nextcloud
        • VERY IMPORTANT - deselect NAT and select DHCP
        • Click advanced properties -> custom properties
          • Enable allow_tun (this allows tunneling into the network).
        • Click save.
          • The installation will take a while.
      • Once installed, click on nextcloud under jail.
        • Click STOP.
        • Check boot.
        • Click on mount points.
        • Click add.
        • Under source, utilize the path to your shared folder.
        • Under destination, use this path
          • /mnt/nameofpool/iocage/jails/nextcloud/root/media
        • Click save.
      • Now you need to find out the username and password to your nextcloud account.
        • Go back to Plugins and click START.
        • Go to Jails from the left side panel.
        • Click on nextcloud and click on shell.
          • Enter the following command.
            • cat /root/PLUGIN_INFO
          • The username and password should be under nextcloud admin user and password.
  • Go back to Plugins.
    • Click manage under the nextcloud plugin.
    • Login using the credentials found just before.
      • Go to the settings page, it should be on the drop down menu that shows up when you click the circle profile icon on the top right.
      • Go to Administration -> External storages
      • Under external storage, select Local
      • Under configuration, enter the code below
        • /media
      • Now go to files
        • You should see your shared folder with this icon if everything was followed successfully!
          • 

Now the simple part is done. To complete remote access to your files, SSL certification for your nextcloud instance must be made. However, before that is done, I suggest you beef up your security to your nextcloud instance by installing the following apps, under apps -> security

• Install the following
  • Brute-force settings
  • Ransomware protection
  • Suspicious login
  • Two-Factor TOTP Provider
  • GeoBlocker
• Go to settings -> security
  • To enable TOTP
    • Click on generate backup codes
      • Store this somewhere safe
    • Click on Enable TOTP
      • Use your preferred TOTP provider to set up the rest. I use DUO on my mobile phone.
• Go to settings -> GeoBlocker
  • To enable GeoBlocker
    • From the dropdown menu under Service, select RIRData
      • Note - there are other options for this service, however, I found that none of these seemed to work for me without any issues.
    • Click update database
      • This will take a while
    • From country selection, select what countries you want to block
      • Most block all countries in Asia, but it's up to you.
    • Under reaction, check all of the boxes.
    • Once the database has completed updated, check the box under Test and use an IP address that would be in the country you blocked.
      • Log out and try to log back in to see if it works. It only uses this IP address to login once, so once it fails you should be fine to log back in without any issue.
• Note all of the other apps you installed should run automatically without setup.

Now that your nextcloud instance is set up and security is beefed up, time to finish setting up remote access to it. The following will enable SSH to your TrueNAS machine and create a public and private key to ensure no one without access to your private key can SSH into your server.

• Go back to your TrueNAS WebGUI and go to Services
  • Enable SSH
  • Under general options, select Allow TCP Port Forwarding
  • Under TCP port, enter a random port number from 1000-65535 of your choice. Note this.
  • Click save.
• Download Putty, just google it. (this allows all changes made through SSH to be saved in the nextcloud instance. Simply using the shell from the WebGUI does not do this!)
• Run PuttyGen (this should have been automatically downloaded alongside Putty)
  • Click on Generate (default settings should be fine)
  • Under key passphrase add a password.
  • Save the public key.
  • Save the private key. Just name it pubkey
  • Save the private key. Name it id_rsa
    • Note - I suggest saving the private key on a removable USB drive for added security. DO NOT SHARE THIS FILE WITH ANYONE.
  • Copy the ENTIRETY of the text under Public key for pasting into OpenSSH authorized_keys file:
• Go back to your TrueNAS WebGUI and go to System -> SSH Keypairs
  • Click add
  • Name it SSH
  • Paste in the text you copied earlier under public key.
    • Note - DO NOT ENTER THE PRIVATE KEY INTO THIS. You do not have to, the private key will pair with the public key automatically!!!
  • Click submit
• Go to System -> SSH connection
  • Click add
  • Name it SSH Connection
  • Under host, enter the IP address to your TrueNAS machine (same as the IP to access your WebGUI)
  • Under port, enter the port you previously entered for SSH in Services
  • Under username, enter root
  • Under private key, use the dropdown menu to select SSH
  • Copy the Remote Host Key, excluding the first line that beings with ssh
  • Click save.
• Now to test if SSH has been successfully enabled.
  • Run Putty
    • Put in the IP address of you TrueNAS machine under Host Name and port of your SSH under Port
    • Go to SSH -> Host keys
      • Under key, paste the Remote Host Key you previously copied and click add key.
    • Go to SSH -> Auth
      • Click browse and find your private key you named id_rsa
    • Go back to Session and click save!!!!
    • Now click open.
      • Login as: root
      • Put in your password.
      • If you see the following, everything has been successfully set up!
        • 

Now that SSH has been set up with a pub/priv key pair, it's time to finish Remote Access to your nextcloud instance using SSL. This will ensure all traffic to your nextcloud instance is encrypted and allow https/http access to your nextcloud instance through simply going to the DDNS domain you set up previously from a web browser.

• Run Putty
  • Load the saved session from before
    • use the code
      • sudo iocage console nextcloud
  • Go to https://drive.google.com/file/d/1E68zif8k6V70KBqMGS09Xp_-eGb-RquX/view
    • This video runs through it
      • https://www.youtube.com/watch?v=fvmxl30pC6Y&t=405s&ab_channel=NhanNguyen
    • Use the directions there.
  • Note that the following has simply created a self-signed CA and certificates for your nextcloud domain.
• Restart your nextcloud instance via TrueNAS WebGUI
• Go to your router configuration page, to do this open command prompt and enter ipconfig
  • Enter the IP under default gateway in your web browser
    • Default username and password for this is usually on your router itself.
  • Once in, go to port forwarding
    • For HTTPS
      • The server IP address should be the IP address of your nextcloud instance on your local network.
      • Select TCP/UDP
      • Under Internal port, use 443
      • Name it HTTPS
      • Save
    • For HTTP
      • The server IP address should be the IP address of your nextcloud instance on your local network.
      • Select TCP/UDP
      • Under Internal port, use 80
      • Name it HTTPS
      • Save
• Now you should be able to connect to your nextcloud instance remotely using https://YourDDNS, i.e. https://example.duckdns.org

You can just leave things the way they are, however, if you desire to obtain a universally approved CA and certificates for your nextcloud instance, use the following instructions below.

• Run Putty
  • Enter following code one by one.
    • sudo iocage console
    • pkg install py37-certbot
    • cd /usr/ports/security/py-certbot && make install clean
    • certbot certonly --webroot
      • under domain names, enter your DuckDNS domain name, i.e. example.duckdns.org
      • Under webroot enter the following
        • /usr/local/www/nextcloud/
  • The output, under IMPORTANT NOTES should tell you where the key files have been save. Note these.
  • Enter the following code
    • nano /usr/local/etc/nginx/conf.d/nextcloud.conf
      • Edit the following from
        • server {
          listen 0.0.0.0:443 default_server ssl http2;
          listen [::]:443 default_server ssl http2;
          ssl_certificate "/usr/local/etc/ssl/nginx/nextcloud.crt";
          ssl_certificate_key "/usr/local/etc/ssl/nginx/nextcloud.key";
          
          ssl_session_timeout 120m;
          ssl_session_cache shared:ssl:16m;
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
      • To
        • server {
          listen 0.0.0.0:443 default_server ssl http2;
          listen [::]:443 default_server ssl http2;
          ssl_certificate "NewPathToCertificateAndChain";
          ssl_certificate_key "NewPathToKeyFile";
          
          ssl_session_timeout 120m;
          ssl_session_cache shared:ssl:16m;
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
          • change the bolded text to the respective paths noted above.
• Restart your nextcloud instance via the TrueNAS WebGUI
• Go to https://yourdomain.duckdns.org and check if the lock symbol is on the URL space. If so everything has been done correctly.

Congrats! Now you have a trusted CA signing your SSL certificates to your Nextcloud instance. Now time to allow remote SSH access to our TrueNAS machine and WebGUI.

• Go to your router configuration page, i.e. the default gateway under ipconfig in command prompt
  • Go to port forwarding
    • For SSH
      • The server IP address should be the IP address of your TrueNAS machine on your local network. i.e. 192.168.0.10
      • Select TCP/UDP
      • Under Internal port, use the SSH port number you previously selected
      • Name it SSH
      • Save

Now you should be able to SSH to your TrueNAS machine remotely from anywhere as long as you have access to your private key. Now time to set up remote access to WebGUI.

• Run Putty
  • Load the previously saved session
  • Go to SSH -> Tunnels
    • Click Dynamic and Auto
    • In the source port, enter 15443
    • Click add
  • Go to session and save the session!
• Install Mozilla Firefox
  • Run Firefox
  • Go to options -> general -> network settings
  • Click manual proxy configuration
  • Click SOCKS V5
  • Under SOCKS Host, enter localhost
  • Under the corresponding port, enter 15443
  • Under No proxy for, enter
    • localhost, 127.0.0.1
  • Enable Proxy DNS when using SOCKS v5 and Enable DNS over HTTPS
  • Everything should save automatically.
• To test if everything is working correctly
  • Connect to a remote network
  • Run Putty using the saved previous session
  • Open Firefox
  • Go to your TrueNAS IP address
    • i.e. 192.168.0.10 NOT example.duckdns.org
  • If you can see the login page, everything worked!!!
• Keep in mind, to access the WebGUI remotely, you must always be connected to your TrueNAS machine via SSH in Putty!

Congrats you're finished. Now you have complete secure remote access to your TrueNAS files and system.




Common Problems Troubleshooting

• If nextcloud shows something along the lines of this is not a trusted domain, use the following code
  • cd /usr/ports/editors/nano/ && make install clean BATCH=yes
  • nano /usr/local/www/nextcloud/config/config.php
  • Add your domain/IP address you desire using the format you see in the file.
    • i.e. 192.168.0.20 or/and example.duckdns.org

 

[yellowbananabus]

Regarding troubleshooting, note that the IP address or domain you enter is going to be the address of the SERVER not the client!

 

[Hamimi]

Thanks for this great tutorial. I am having a crazy problem though at this step "Now to test if SSH has been successfully enabled".
When you say excluding the first line after " excluding the first line that beings with ssh" not very clear as mine there is nothing in front of the "ssh".
When I run Putty a new black window appears and as I put "root" and enter, either of these two errors happens: 1) "host key did not appear in manually configured list"
2) once the black window appears and I enter root then "server refused our key".

Please help me so I can get thing going as well.

Many thanks,
Hamimi

 

[Lepo]

Thanks for this great tutorial. I am having a crazy problem though at this step "Now to test if SSH has been successfully enabled".
When you say excluding the first line after " excluding the first line that beings with ssh" not very clear as mine there is nothing in front of the "ssh".
When I run Putty a new black window appears and as I put "root" and enter, either of these two errors happens: 1) "host key did not appear in manually configured list"
2) once the black window appears and I enter root then "server refused our key".

Please help me so I can get thing going as well.

Many thanks,
Hamimi

I have also been stuck at that part. What worked for me was adding the public key to the 'root' user under Authentication -> SSH Public Key. Hope this helps.

 

[joeschmuck]

While I have not tried these instructions out, I would like to offer up some constructive feedback. Insteads of one very long running procedure, break it up into step numbers or some kind of sections so it's easy to locate when someone has a problem they could just say "at section SSH Key, step 3, It did not work as expected". I'd like to give these instructions a shot myself this weekend.

 

[Shanay]

is it just me or are the pictures not showing?

 

[joeschmuck]

is it just me or are the pictures not showing?

They show up for me.

 

[FadedQuill7]

Stuck on this part.

• Click manage under the nextcloud plugin.
• Login using the credentials found just before.
  • Go to the settings page, it should be on the drop down menu that shows up when you click the circle profile icon on the top right.
  • Go to Administration -> External storages (NOTE: cant seem to find this section on nextcloud.)
  • Under external storage, select Local
  • Under configuration, enter the code below
    • /media
  • Now go to files
    • You should see your shared folder with this icon if everything was followed successfully!
      
      
      

 

[Royal_Dakat]

Stuck on this part.

• Click manage under the nextcloud plugin.
• Login using the credentials found just before.
  • Go to the settings page, it should be on the drop down menu that shows up when you click the circle profile icon on the top right.
  • Go to Administration -> External storages (NOTE: cant seem to find this section on nextcloud.)
  • Under external storage, select Local
  • Under configuration, enter the code below
    • /media
  • Now go to files
    • You should see your shared folder with this icon if everything was followed successfully!
      
      View attachment 54208

I'm having the same exact problem, I don't know where to find the "External Storages" section

 

[Royal_Dakat]

Stuck on this part.

• Click manage under the nextcloud plugin.
• Login using the credentials found just before.
  • Go to the settings page, it should be on the drop down menu that shows up when you click the circle profile icon on the top right.
  • Go to Administration -> External storages (NOTE: cant seem to find this section on nextcloud.)
  • Under external storage, select Local
  • Under configuration, enter the code below
    • /media
  • Now go to files
    • You should see your shared folder with this icon if everything was followed successfully!
      
      View attachment 54208

OK good news, turns out the reason this is occurring is due to the app not being enabled, go to your apps from the menu in the top right where you profile icon is and select "Apps." Then scroll down till you find "external storages" and enable it. Continue as normal from there.

 

[DrMephisto]

Go back to Plugins.

• Click manage under the nextcloud plugin.
• Login using the credentials found just before.
  • Go to the settings page, it should be on the drop down menu that shows up when you click the circle profile icon on the top right.
  • Go to Administration -> External storages
  • Under external storage, select Local
  • Under configuration, enter the code below
    • /media
  • Now go to files
    • You should see your shared folder with this icon if everything was followed successfully

I followed all the steps as written, however when I get to entering "/media" under configuration. Nextcloud gives an error and tells me to check configuration. I can't figure out what I'm doing wrong

 

[jpkl1a873]

• Now you need to find out the username and password to your nextcloud account.
  • Go back to Plugins and click START.
  • Go to Jails from the left side panel.
  • Click on nextcloud and click on shell.
    • Enter the following command.
      • cat /root/PLUGIN_INFO
    • The username and password should be under nextcloud admin user and password.

I love your directions and they worked flawlessly until the remote access set up parts.
I have gotten the duckdns to work now.
But am stuck on this step.
So I click nextcloud in the main page. then Shell on the left side. I enter the command and get a error "No such file or directory"
I tried space between cat and /root and without.
What am I missing? really want to be able to access remotely.

 

[jacpetWizard]

Great Guide!

i ran into few issues and seemed to have solved them all.

DHCP - Nextcloud
kept getting error at around that it couldnt get ip adress, not choosing nat and dhcp and then giving a static ip seemed to solve this, but read the dhcp icon and check you enabled the other chek boxes that are required.

Nextcloud access issue
i used the shell under jail to search for the config file find / -name config.php
the cd (path listed) to get to the php file, at the line were you see an ip adress i added my truenas and nextcloud ip adress and then it worked just remember to follow the syntax

SSH Public key
i opened the SSH key in notepad and copied entire text kept getting error, instead i copied the key directly from the public key field in puttygen.

SSH putty Host key
kept getting issues with the host key in putty, after a while i discovered that the line breaks in truenas causes only partial parts of the key to be copied, i pasted it into notepad and saw the line breaks and pasted it all into the host key filed in putty then it worked!

good luck to all

 

[steve907]

Do these instructions apply to a particular version of TrueNAS?

With v13, when I attempt to install the Nextcloud plug-in, it requires a Jail Name. Any guidance on that? Thank you.

 

[DrMephisto]

Do these instructions apply to a particular version of TrueNAS?

With v13, when I attempt to install the Nextcloud plug-in, it requires a Jail Name. Any guidance on that? Thank you.

just name it whatever you want, i usually just name it whatever the plugin is going to be so for nextcloud i would put nextcloud or nc

 

[NAVI]

This tutorial will go over all the basics in detail for a complete beginner that you will have to complete to set up a NAS on a dedicated machine you can access from both from a local and remote network securely, while also having the ability to SSH into the NAS securely remotely, allowing remote access to your NAS shell and the web GUI. To set up the NAS on a VM, simply follow these instructions, utilizing a VM. Note all the bolded text, these are important. Please keep in mind I recently got into this and am in no way a professional, however, doing the following has worked error-free for me.

Also quick comment regarding pasting code in shell/SSH (Putty). For the shell, to paste use CTRL+V. For the Putty just right click.

Required Materials

• 1 USB (1 GB min.)
• 2 separate hard drives or SSDs
• A dedicated computer to run the NAS from
• A router that allows port forwarding (most routers allow this)

Example IP addresses

• TrueNAS machine: 192.168.0.10
• Nextcloud Instance: 192.168.0.20
• Router Config Page: 192.168.0.1
• DDNS: example.duckdns.org

Instructions

• To proceed, keep in mind you need both an install drive and a boot drive, separate from each other. The following will be about how to set up the install drive.
  • Begin by downloading the ISO image of TrueNAS and Rufus - just google the links to these.
  • Using Rufus, mount the ISO image to your drive of choice. Note - you can just use a USB for this step (must be at least 1 GB)
    • You can keep all the settings at the default on Rufus.
  • After it has finished mounting, go into the BIOS of your future NAS machine.
    • Make sure that the boot order has the UEFI USB as the top priority, and uncheck secure boot (it will not boot if this isn't done).
• The following is about how to set up the boot drive.
  • Now plug in your USB drive into your future NAS machine and boot it up.
    • The program will automatically start.
  • From the settings page select the drive you desire to make your boot drive.
    • Note - though many tutorials state that it can be a USB drive, this has not worked for me AT ALL. Using a dedicated hard drive, external or internal is your best bet (keep in mind this will FORMAT ALL DATA on your hard drive).
  • In the settings, it will ask if the device should install in UEFI or Legacy mode. UEFI should work for all modern drives.
  • Create a root password.
  • Now allow the program to install the boot media onto the hard drive.
  • Once the installation is complete, you can power down your machine, unplug the USB, and keep the hard drive plugged in. PLUG IN AN ETHERNET CABLE (WiFi does not work on TrueNAS). Also plug in a separate hard drive (this will come in handy later).
  • Start up your machine again.
    • If you did everything correctly, the machine should automatically boot into the TrueNAS OS and begin installing more necessary files (this will take a while so just grab a cup of coffee).
• The following is how to configure your settings on TrueNAS.
  • After everything is installed, the shell will give you a few options that look like the following
  • 
    
    
  • Everything should technically be ready to go, so type in one of the two IP addresses you see below on a web browser on a different computer that is connected to your local internet. I.e. 192.168.0.10
    • The WebGUI should pop up looking like the following.
      • 
        
        
      • If you don't see this, then refer to the below.
        • In your TrueNAS machine, type 1 and press enter to get into the network configuration.
        • Here type in the number of your network interface from the options, should usually be 1.
        • Then when it asks whether you want to reset the network configuration, type y for yes and press enter.
        • Note - though you can type 1 and press enter again to change the IP address of your TrueNAS machine, I found it always eventually changed back to its default IP address, so to lessen confusion, I advise against this.
  • The default username is root, the password should be the root password you set up in the installation of the TrueNAS boot media.
    • Now you should see the web GUI, it should look like this
    • 
      
      
  • To create shared volumes you can access through connection to your local network, see the following instructions.
    • Go to accounts on the left panel.
      • Click on groups.
        • Click add.
          • Enter a group name (you can leave the GID as it is).
          • Enable permit sudo and samba authentication.
          • Submit.
    • Go to accounts on the left panel.
      • Click on users.
        • Click add.
          • Fill in all the empty field under Identification
          • Uncheck new primary group.
          • Choose the group you made previously from the drop down menu in primary groups.
          • Go ahead and check all of the boxes under Home Directory Permissions.
          • Under Authentication check permit sudo and Samba authentication.
          • Submit.
    • Go to Storage -> Disks on the left panel.
      • Find the name of the disk you desire to use as your NAS shared disk.
        • Note - the shared disk CANNOT be the same disk you have your boot media on. Use the different drive you plugged in previously.
      • Go to Storage -> Pools
        • Click add.
          • Select create new pool then click create pool.
      • Go back to Storage -> Pools
        • You should see the name of your new pool pop up.
        • Click on the three dots on the right side of that name.
          • Click add Zvol (this must be done!)
            • Put in a name and select a size for the Zvol (for a 1TB drive I used 1 GB, this is block device mainly used for VMs, so you can use less if you don't plan on using VMs on your NAS, more if you do).
            • Click submit.
        • Click on the three dots on the right side of the pool once again.
          • Click add dataset.
            • Type in a name and click submit.
        • Now you should be able to see the name of that dataset underneath your pool in Storage -> Pools
        • Click on the three dots on the right side of the name of the dataset.
          • Click on permissions.
            • Set the user under owner to www and group to www.
            • Click apply user and apply group.
            • Under access mode, check all of the boxes.
            • Click apply permissions recursively under advanced.
            • Click save.
        • Click on the three dots on the right side of the name of the dataset.
          • Click on permissions.
            • Click on ACL manager.
            • Click on the preset open under the dropdown menu.
            • Set the user under owner to www and group to www.
            • Click apply user and apply group.
            • Click apply permissions recursively under advanced.
            • Click save
    • Go to Services
      • Enable SMB and click on start automatically.
    • Go to Sharing -> Windows Shares (SMB)
      • Click add.
        • Select the path to your dataset.
        • Click submit.
    • Now to access this folder from your Windows machine on your local network.
      • Go to file explorer -> network
      • Click on the top field and enter the IP address of your TrueNAS machine in this fashion (should be the same as the IP address you used to connect to your WebGUI)
        • \\youripaddress
      • When it asks for username and password, use the username of the new account you created in the WebGUI and its password.
      • If you see your folder, great! If not, refer back to the previous steps to see if you did anything wrong.
• The following is how to set up remote access to your shared folder.
  • The first thing you have to do is go to duckdns.org (this is a DDNS service that allows a static address to your constantly changing IP address to your local network externally).
    • Sign in.
    • Create a domain.
  • Go back to you TrueNAS WebGUI
    • Go to Tasks -> Cron Jobs
      • Click add
        • Enter DuckDNS as the description
        • Under command, enter the following
          • /usr/local/bin/curl "https://www.duckdns.org/update?domains=yoursubdomain&token=yourtoken&ip="
            • To find your subdomain and your token, on DuckDNS.org, your subdomain is the first part before .duckdns.org, and your token should be shown near the top panel of the page. Replace the bolded text with this information.
        • Under schedule, enter how often you want this to run (I selected hourly)
          • This is how often it will update your IP address to coincide with your DDNS domain.
        • Click save.
    • Go to Plugins
      • Note - This tutorial will use Nextcloud for remote access to files as I could not get OpenVPN to work for the life of me. This is a great alternative that offers many options for the user easily.
      • Click on Nextcloud.
        • Click install.
        • Under plugin name, enter nextcloud
        • VERY IMPORTANT - deselect NAT and select DHCP
        • Click advanced properties -> custom properties
          • Enable allow_tun (this allows tunneling into the network).
        • Click save.
          • The installation will take a while.
      • Once installed, click on nextcloud under jail.
        • Click STOP.
        • Check boot.
        • Click on mount points.
        • Click add.
        • Under source, utilize the path to your shared folder.
        • Under destination, use this path
          • /mnt/nameofpool/iocage/jails/nextcloud/root/media
        • Click save.
      • Now you need to find out the username and password to your nextcloud account.
        • Go back to Plugins and click START.
        • Go to Jails from the left side panel.
        • Click on nextcloud and click on shell.
          • Enter the following command.
            • cat /root/PLUGIN_INFO
          • The username and password should be under nextcloud admin user and password.
  • Go back to Plugins.
    • Click manage under the nextcloud plugin.
    • Login using the credentials found just before.
      • Go to the settings page, it should be on the drop down menu that shows up when you click the circle profile icon on the top right.
      • Go to Administration -> External storages
      • Under external storage, select Local
      • Under configuration, enter the code below
        • /media
      • Now go to files
        • You should see your shared folder with this icon if everything was followed successfully!
          • 

Now the simple part is done. To complete remote access to your files, SSL certification for your nextcloud instance must be made. However, before that is done, I suggest you beef up your security to your nextcloud instance by installing the following apps, under apps -> security

• Install the following
  • Brute-force settings
  • Ransomware protection
  • Suspicious login
  • Two-Factor TOTP Provider
  • GeoBlocker
• Go to settings -> security
  • To enable TOTP
    • Click on generate backup codes
      • Store this somewhere safe
    • Click on Enable TOTP
      • Use your preferred TOTP provider to set up the rest. I use DUO on my mobile phone.
• Go to settings -> GeoBlocker
  • To enable GeoBlocker
    • From the dropdown menu under Service, select RIRData
      • Note - there are other options for this service, however, I found that none of these seemed to work for me without any issues.
    • Click update database
      • This will take a while
    • From country selection, select what countries you want to block
      • Most block all countries in Asia, but it's up to you.
    • Under reaction, check all of the boxes.
    • Once the database has completed updated, check the box under Test and use an IP address that would be in the country you blocked.
      • Log out and try to log back in to see if it works. It only uses this IP address to login once, so once it fails you should be fine to log back in without any issue.
• Note all of the other apps you installed should run automatically without setup.

Now that your nextcloud instance is set up and security is beefed up, time to finish setting up remote access to it. The following will enable SSH to your TrueNAS machine and create a public and private key to ensure no one without access to your private key can SSH into your server.

• Go back to your TrueNAS WebGUI and go to Services
  • Enable SSH
  • Under general options, select Allow TCP Port Forwarding
  • Under TCP port, enter a random port number from 1000-65535 of your choice. Note this.
  • Click save.
• Download Putty, just google it. (this allows all changes made through SSH to be saved in the nextcloud instance. Simply using the shell from the WebGUI does not do this!)
• Run PuttyGen (this should have been automatically downloaded alongside Putty)
  • Click on Generate (default settings should be fine)
  • Under key passphrase add a password.
  • Save the public key.
  • Save the private key. Just name it pubkey
  • Save the private key. Name it id_rsa
    • Note - I suggest saving the private key on a removable USB drive for added security. DO NOT SHARE THIS FILE WITH ANYONE.
  • Copy the ENTIRETY of the text under Public key for pasting into OpenSSH authorized_keys file:
• Go back to your TrueNAS WebGUI and go to System -> SSH Keypairs
  • Click add
  • Name it SSH
  • Paste in the text you copied earlier under public key.
    • Note - DO NOT ENTER THE PRIVATE KEY INTO THIS. You do not have to, the private key will pair with the public key automatically!!!
  • Click submit
• Go to System -> SSH connection
  • Click add
  • Name it SSH Connection
  • Under host, enter the IP address to your TrueNAS machine (same as the IP to access your WebGUI)
  • Under port, enter the port you previously entered for SSH in Services
  • Under username, enter root
  • Under private key, use the dropdown menu to select SSH
  • Copy the Remote Host Key, excluding the first line that beings with ssh
  • Click save.
• Now to test if SSH has been successfully enabled.
  • Run Putty
    • Put in the IP address of you TrueNAS machine under Host Name and port of your SSH under Port
    • Go to SSH -> Host keys
      • Under key, paste the Remote Host Key you previously copied and click add key.
    • Go to SSH -> Auth
      • Click browse and find your private key you named id_rsa
    • Go back to Session and click save!!!!
    • Now click open.
      • Login as: root
      • Put in your password.
      • If you see the following, everything has been successfully set up!
        • 

Now that SSH has been set up with a pub/priv key pair, it's time to finish Remote Access to your nextcloud instance using SSL. This will ensure all traffic to your nextcloud instance is encrypted and allow https/http access to your nextcloud instance through simply going to the DDNS domain you set up previously from a web browser.

• Run Putty
  • Load the saved session from before
    • use the code
      • sudo iocage console nextcloud
  • Go to https://drive.google.com/file/d/1E68zif8k6V70KBqMGS09Xp_-eGb-RquX/view
    • This video runs through it
      • https://www.youtube.com/watch?v=fvmxl30pC6Y&t=405s&ab_channel=NhanNguyen
    • Use the directions there.
  • Note that the following has simply created a self-signed CA and certificates for your nextcloud domain.
• Restart your nextcloud instance via TrueNAS WebGUI
• Go to your router configuration page, to do this open command prompt and enter ipconfig
  • Enter the IP under default gateway in your web browser
    • Default username and password for this is usually on your router itself.
  • Once in, go to port forwarding
    • For HTTPS
      • The server IP address should be the IP address of your nextcloud instance on your local network.
      • Select TCP/UDP
      • Under Internal port, use 443
      • Name it HTTPS
      • Save
    • For HTTP
      • The server IP address should be the IP address of your nextcloud instance on your local network.
      • Select TCP/UDP
      • Under Internal port, use 80
      • Name it HTTPS
      • Save
• Now you should be able to connect to your nextcloud instance remotely using https://YourDDNS, i.e. https://example.duckdns.org

You can just leave things the way they are, however, if you desire to obtain a universally approved CA and certificates for your nextcloud instance, use the following instructions below.

• Run Putty
  • Enter following code one by one.
    • sudo iocage console
    • pkg install py37-certbot
    • cd /usr/ports/security/py-certbot && make install clean
    • certbot certonly --webroot
      • under domain names, enter your DuckDNS domain name, i.e. example.duckdns.org
      • Under webroot enter the following
        • /usr/local/www/nextcloud/
  • The output, under IMPORTANT NOTES should tell you where the key files have been save. Note these.
  • Enter the following code
    • nano /usr/local/etc/nginx/conf.d/nextcloud.conf
      • Edit the following from
        • server {
          listen 0.0.0.0:443 default_server ssl http2;
          listen [::]:443 default_server ssl http2;
          ssl_certificate "/usr/local/etc/ssl/nginx/nextcloud.crt";
          ssl_certificate_key "/usr/local/etc/ssl/nginx/nextcloud.key";
          
          ssl_session_timeout 120m;
          ssl_session_cache shared:ssl:16m;
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
      • To
        • server {
          listen 0.0.0.0:443 default_server ssl http2;
          listen [::]:443 default_server ssl http2;
          ssl_certificate "NewPathToCertificateAndChain";
          ssl_certificate_key "NewPathToKeyFile";
          
          ssl_session_timeout 120m;
          ssl_session_cache shared:ssl:16m;
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
          • change the bolded text to the respective paths noted above.
• Restart your nextcloud instance via the TrueNAS WebGUI
• Go to https://yourdomain.duckdns.org and check if the lock symbol is on the URL space. If so everything has been done correctly.

Congrats! Now you have a trusted CA signing your SSL certificates to your Nextcloud instance. Now time to allow remote SSH access to our TrueNAS machine and WebGUI.

• Go to your router configuration page, i.e. the default gateway under ipconfig in command prompt
  • Go to port forwarding
    • For SSH
      • The server IP address should be the IP address of your TrueNAS machine on your local network. i.e. 192.168.0.10
      • Select TCP/UDP
      • Under Internal port, use the SSH port number you previously selected
      • Name it SSH
      • Save

Now you should be able to SSH to your TrueNAS machine remotely from anywhere as long as you have access to your private key. Now time to set up remote access to WebGUI.

• Run Putty
  • Load the previously saved session
  • Go to SSH -> Tunnels
    • Click Dynamic and Auto
    • In the source port, enter 15443
    • Click add
  • Go to session and save the session!
• Install Mozilla Firefox
  • Run Firefox
  • Go to options -> general -> network settings
  • Click manual proxy configuration
  • Click SOCKS V5
  • Under SOCKS Host, enter localhost
  • Under the corresponding port, enter 15443
  • Under No proxy for, enter
    • localhost, 127.0.0.1
  • Enable Proxy DNS when using SOCKS v5 and Enable DNS over HTTPS
  • Everything should save automatically.
• To test if everything is working correctly
  • Connect to a remote network
  • Run Putty using the saved previous session
  • Open Firefox
  • Go to your TrueNAS IP address
    • i.e. 192.168.0.10 NOT example.duckdns.org
  • If you can see the login page, everything worked!!!
• Keep in mind, to access the WebGUI remotely, you must always be connected to your TrueNAS machine via SSH in Putty!

Congrats you're finished. Now you have complete secure remote access to your TrueNAS files and system.




Common Problems Troubleshooting

• If nextcloud shows something along the lines of this is not a trusted domain, use the following code
  • cd /usr/ports/editors/nano/ && make install clean BATCH=yes
  • nano /usr/local/www/nextcloud/config/config.php
  • Add your domain/IP address you desire using the format you see in the file.
    • i.e. 192.168.0.20 or/and example.duckdns.org

I'm not sure if I messed up or if the TrueNAS 13 stable just has accesses the information differently. I tried looking for the answer but incidentally stumbled on to it by mistake. So on the part where You would go to the shell for NextCloud and type "cat /root/PLUGIN_INFO" I was getting "command not found" It turns out the login information is located under Plugins, click NextCloud and then "post install notes". In this it list
Database Name:
Database User:
Database Password:
Nextcloud Admin User:
Nextcloud Admin Password:

all the information above.

 

[NAVI]

Okay so I ran into this issue and eventually found the answer I'm not sure if it's been mentioned but when you get to the part about external storage.

• Go to the settings page, it should be on the drop down menu that shows up when you click the circle profile icon on the top right.
• Go to Administration -> External storages

Instead of going to administration click the profile icon and go into apps. find the External storage and you will need to enable it. Now proceed to go to administration and external storage is listed.

 

[Thund3rBay]

I am currently stuck at the part where I am setting up SSH Connections. When I go to add it and set up everything as listed then hit submit. It just infinitely loads saying please wait. Don't really know what to do to get it working.

 

[NAVI]

I am currently stuck at the part where I am setting up SSH Connections. When I go to add it and set up everything as listed then hit submit. It just infinitely loads saying please wait. Don't really know what to do to get it working.

It's a known bug. A fix is to go through the shell. Try this.

Cannot save "SSH Connections"

Ran into this on my test system today. https://jira.ixsystems.com/browse/NAS-116580?jql=text%20~%20ssh%20ORDER%20BY%20created%20DESC Could someone please verify?

www.truenas.com

 

[paradoxiom]

Anything like this with working pics and / or an updated guide? I don't need security just quick remote access for a day.