February 2024 Update:
This Tutorial is deprecated since iX Systems has deprecated OpenVPN as part of TrueNAS Scale. See my WireGuard Tutorial here: https://www.reddit.com/r/truenas/comments/1ahkp3s/tutorial_getting_a_wireguard_server_setup_so_the/
Introduction
I travel a lot and sometimes I need to protect my internet traffic and get files I have stored on my file server. Up until about 6 months ago this wasn’t doable from my experience on TrueNAS and I had to use a pfSense router to accomplish this. There are some restrictions that need to be addressed, but overall its now working as intended. You’ll need to do the following before you can even start setting up the OpenVPN server. Must be on TrueNAS Scale 22.12.1 or newer, there is an issue with the OpenVPN server implementation in older versions. Must have a URL pointing to your Internet facing IP address, you can use a dynamic DNS service or buy a domain name an set the name servers to point to your WAN IP (only do this if you have a static IP). Part of this is due to a YouTube video by Aaron Chu, which is a bit hard to understand due to his accent, but is great a showing the steps that need to be done.
OpenVPN Server Credentials Setup
Credentials: TrueNAS’s implementation of OpenVPN is a bit finickier than usual and requires the certificate fields to be correctly filled out or it will dump out a error.
Creating the Certificate Authority (CA) Certificate: Go to “Credentials > Certificates > Certificate Authorities > Add” and do the following steps, each is numbered for the steps in TrueNAS.
- Name: Use a unique name for what this CA is the root for, I used OpenVPN_CAType: Select "Internal CA"Profile: “Openvpn Root CA”
- I suggest to only change the Lifetime to 3650 (10 years) and leave the rest as default. Note these settings are only to adjust the certificate key’s encryption, not the VPN tunnel encryption.
- This part is important to fill out correctly or OpenVPN will have issues with the certificates.Country: Where ever you live or notState: Where ever you live or notLocality: (City) Where ever you live or notOrganization: *Name, Company, Screenhandle, etc.*Organizational Unit: I left this blankEmail: *Enter an email real or not.*Common Name: *While not required, Its required for OpenVPN and must be the URL that is exposed to the internet.*Subject Alternate Names: Use the same entry as the Common Name
- Leave as default unless you have a reason to change these.
- Review to make sure you entered everything correctly and click “Save”
Creating the Server Certificate: Go to “Credentials > Certificates > Certificates > Add” and do the following steps, each is numbered for the steps in TrueNAS.
- Name: Use a unique name for what this certificate is for, I used OpenVPN_ServerType: Select "Internal CA"Profile: “Openvpn Server Certificate”
- Signing Certificate Authority: Select the CA you just created for OpenVPNKey Type: *Leave as default unless you have a reason to change it.*Key Length: *Leave as default unless you have a reason to change it.*Digest Algorithm: *Leave as default unless you have a reason to change it.*Lifetime: 3650 (10 years)
- This part is important to fill out correctly or OpenVPN will have issues with the certificates.Country: Where ever you live or notState: Where ever you live or notLocality: (City) Where ever you live or notOrganization: *Name, Company, Screenhandle, etc.*Organizational Unit: I left this blankEmail: *Enter an email real or not.*Common Name: *While not required, Its required for OpenVPN and must be the URL that is exposed to the internet.*Subject Alternate Names: Use the same entry as the Common Name
- Leave as default unless you have a reason to change these.
- Review to make sure you entered everything correctly and click “Save”
Creating the Client Certificate: Go to “Credentials > Certificates > Certificates > Add” and do the following steps, each is numbered for the steps in TrueNAS.
- Name: Use a unique name for what this certificate is for, I used OpenVPN_ClientType: Select "Internal CA"Profile: “Openvpn Client Certificate”
- Signing Certificate Authority: Select the CA you just created for OpenVPNKey Type: *Leave as default unless you have a reason to change it.*Key Length: *Leave as default unless you have a reason to change it.*Digest Algorithm: *Leave as default unless you have a reason to change it.*Lifetime: 3650 (10 years)
- This part is important to fill out correctly or OpenVPN will have issues with the certificates.Country: Where ever you live or notState: Where ever you live or notLocality: (City) Where ever you live or notOrganization: *Name, Company, Screenhandle, etc.*Organizational Unit: I left this blankEmail: *Enter an email real or not.*Common Name: *While not required, Its required for OpenVPN and must be the URL that is exposed to the internet.*Subject Alternate Names: Use the same entry as the Common Name
- Leave as default unless you have a reason to change these.
- Review to make sure you entered everything correctly and click “Save”
OpenVPN Server Setup
Now to setup the server service, go to "Network > OpenVPN > Server > ✎ " and fill the following out:
- Server Certificate: Select the certificate that you created eg: OpenVPN_Server
- Root CA: Select the certificate authority that you created eg: OpenVPN_CA
- Server: This is the VPN network address eg: 192.168.2.0/24
- Port: This is the port that will listen for VPN connections, you’ll need to forward this port in your device that had the internet facing IP (typically a router) default: 1194
- Authentication Algorithm & Cipher: Changed these to change the VPN tunnel encryption, suggest leaving it as is.
- Compression: Suggest leaving it at none
- Protocol: Suggest leaving it at UDP
- Device Type: Suggest leaving it at TUN, if you change it to TAP, devices with restricted hardware permissions (iPhones, Android etc) can not connect.
- Topology: Suggest leaving it at SUBNET only change if you need to use a different topology
- TLS Crypt Auth Enabled: Allow for the use of key file logins, convenient so you don’t have to enter a username and password every time
- Additional Parameters: This is where you can set OpenVPN server settings and push settings to clients, here a list of what I use, remember to change the IP addresses and remove the comments “#”:
push "route 192.168.1.0 255.255.255.0" # setup the client to route to my LAN
push "redirect-gateway def1" # Force the VPN client to only use my LAN Gateway
push "dhcp-option DNS 192.168.1.2" # Add new DNS server, TrueNAS's DNS
push "dhcp-option DNS 192.168.1.1" # Add new DNS server, routers's DNS
duplicate-cn # Allow for the same login/key to connect multiple times at once, useful for a laptop and a phone at once.
- TLS Crypt Auth: This is an auto generated key
Click Save
Now go to “System Settings > Services” and check “Start Automatically” for OpenVPN Server.
Network Setup
The server’s firewall settings need to be adjusted so that it allows the VPN user to connect to both the internet and LAN as if they were physically located on the server’s LAN. To enable these settings, go to “System Settings > Advanced”
Sysctl:
| Variable | Value | Description | Enabled |
|---|---|---|---|
| net.ipv4.ip_forward | 1 | Enable IP forwarding | true |
Init/Shutdown Scripts:
| Description | Type | Command | When | Enabled | Timeout |
|---|---|---|---|---|---|
| NAT Rule 1 | Command | nft add table ip vpn | Post Init | true | 10(default) |
| NAT Rule 2 | Command | nft ‘add chain ip vpn prerouting { type nat hook prerouting priority 0 ; }’ | Post Init | true | 10(default) |
| NAT Rule 3 | Command | nft ‘add chain ip vpn postrouting { type nat hook postrouting priority 100 ; }’ | Post Init | true | 10(default) |
| NAT Rule 4 | Command | nft ‘add rule vpn postrouting iifname [openvpn-server interface name] oifname [physical NIC to route to] ip saddr [use your vpn network 192.168.2.0/24] masquerade’ | Post Init | true | 10(default) |
^(Note, in NAT Rule 4, you need to change the interface and network that is to be used.)
Now reboot the TrueNAS server to implement the above settings.
Conclusion
This should get you to a point that the OpenVPN server is running and you can add clients. This will force all vpn traffic to go through the home router and it also allows the VPN client to see your LAN so if you have shares or LAN restricted services, they will be accessible.
