[2026-05-12] taiga sync: family/.DS_Store family/_index.md family/how-to/htpc-access.md family/how-to/htpc-gaming-plans.md family/how-to/htpc-magic4pc.md family/how-to/htpc-migration-plan.md family/how-to/htpc-system.md family/how-to/htpc-webos-luna.md family/how-to/htpc.md family/how-to/magic4pc-webos.md

2026-05-12 11:02:16 -07:00
commit d25629e140
32 changed files with 3821 additions and 0 deletions
@@ -0,0 +1,207 @@
+# TrueNAS Remote Access Cheat Sheet
+
+## Network Layout
+```
+Internet (90.189.160.148 / mallexxx.duckdns.org)
+    └── GPON Router (192.168.0.1) — Rostelecom, Realtek-based
+            ├── OpenWrt (192.168.0.11) — WAN, acts as main router
+            │       └── TrueNAS (192.168.2.197)
+            └── ZONT heating controller (192.168.0.10)
+```
+
+## VPS
+- IP: `91.207.28.205`
+- Tunnel user: `tun` (shell `/bin/false`, key auth only)
+
+---
+
+## Method 1 — Reverse SSH Tunnel via VPS (primary)
+
+### How it works
+TrueNAS dials out to VPS, VPS exposes port 2222 → TrueNAS SSH.
+
+### TrueNAS script
+`/mnt/RED_2TB/system/tunnel.sh` — runs on boot via Init/Shutdown Scripts.
+
+### Connect to TrueNAS
+```bash
+ssh -p 2222 truenas_admin@91.207.28.205
+```
+
+### Enable/disable access on VPS
+```bash
+passwd -u tun   # enable
+passwd -l tun   # disable
+```
+
+### Start tunnel manually (if not running)
+```bash
+# On TrueNAS shell (as root)
+sudo bash /mnt/RED_2TB/system/tunnel.sh &
+```
+
+### Check tunnel is active on VPS
+```bash
+ss -tlnp | grep 2222
+```
+
+### Check tunnel connection from TrueNAS
+```bash
+ss -tnp | grep 91.207.28.205
+```
+
+### Kill all VPS SSH sessions after delay
+```bash
+(sleep 600 && pkill -f "ssh.*91.207.28.205") &
+```
+
+---
+
+## Method 2 — Access GPON Router UI remotely
+
+### How it works
+OpenWrt → reverse tunnel to VPS → forward to GPON UI (192.168.0.1:80)
+
+### Step 1 — On OpenWrt, open reverse tunnel to VPS
+```bash
+ssh -i ~/.ssh/id_ed25519 -N -R 8081:192.168.0.1:80 root@91.207.28.205
+```
+
+### Step 2 — On your machine, forward locally
+```bash
+ssh -L 9091:localhost:8081 root@91.207.28.205
+```
+
+### Step 3 — Open in browser
+```
+http://localhost:9091
+```
+
+---
+
+## Method 3 — Access TrueNAS Web UI remotely
+
+TrueNAS blocks TCP forwarding (`administratively prohibited`), so direct port forward through TrueNAS SSH doesn't work.
+
+### Workaround via OpenWrt
+```bash
+# On OpenWrt
+ssh -i ~/.ssh/id_ed25519 -N -R 8082:192.168.2.197:80 root@91.207.28.205
+
+# On your machine
+ssh -L 9092:localhost:8082 root@91.207.28.205
+```
+Then open `http://localhost:9092`
+
+---
+
+## OpenWrt SSH access
+```bash
+# Direct (local network)
+ssh root@192.168.2.2
+
+# Via TrueNAS tunnel
+ssh -p 2222 truenas_admin@91.207.28.205
+# then: ssh root@192.168.2.2
+```
+
+OpenWrt uses **dropbear** SSH client — no `-v` flag, use `-i` for key:
+```bash
+ssh -i ~/.ssh/id_ed25519 user@host
+```
+
+---
+
+## TrueNAS Notes
+
+### Init/Shutdown Scripts
+```bash
+# List all scripts
+midclt call initshutdownscript.query
+
+# Add new script
+midclt call initshutdownscript.create '{"command":"bash /path/to/script.sh &","type":"COMMAND","when":"POSTINIT","enabled":true,"timeout":10}'
+```
+
+### SSH authorized keys
+```bash
+# View
+midclt call user.query | python3 -c "import sys,json; users=json.load(sys.stdin); [print(u['sshpubkey']) for u in users if u['username']=='truenas_admin']"
+
+# Update (replace all keys)
+midclt call user.update 70 '{"sshpubkey":"key1\nkey2\nkey3"}'
+
+# truenas_admin user ID: 70
+# authorized_keys file: /home/truenas_admin/.ssh/authorized_keys
+```
+
+### TrueNAS shells
+- **Shell 6** — TrueNAS CLI (own interface, limited commands)
+- **Shell 7** — Linux bash (full commands, use this for SSH/scripts)
+
+---
+
+## DuckDNS / External Access (mallexxx.duckdns.org)
+
+### Verify DNS matches public IP
+```bash
+curl ifconfig.me
+nslookup mallexxx.duckdns.org
+```
+
+### Test port reachability from outside
+```bash
+nc -zv 90.189.160.148 80
+nc -zv 90.189.160.148 443
+nc -zv 90.189.160.148 22
+```
+
+### Port forwarding on OpenWrt
+```bash
+uci show firewall | grep redirect
+```
+
+Key services:
+| Service | External port | Internal |
+|---|---|---|
+| TrueNAS SSH | 22 | 192.168.2.197:22 |
+| Caddy HTTP | 80 | 192.168.2.197:8088 |
+| Caddy HTTPS | 443 | 192.168.2.197:8443 |
+| MQTT | 1883 | 192.168.2.197:1883 |
+| Transmission | 51413 | 192.168.2.197:51413 |
+
+---
+
+## VPS sshd_config (relevant settings)
+```
+GatewayPorts yes
+AllowTcpForwarding yes
+PermitRootLogin yes
+```
+Reload after changes: `systemctl reload sshd`
+
+---
+
+## Troubleshooting
+
+### Tunnel not connecting after reboot
+1. Check script exists: `cat /mnt/RED_2TB/system/tunnel.sh`
+2. Check Init/Shutdown script: `midclt call initshutdownscript.query`
+3. Start manually: `sudo bash /mnt/RED_2TB/system/tunnel.sh &`
+4. Check tun user is unlocked on VPS: `passwd -u tun`
+
+### Port 2222 already in use on VPS
+Another tunnel instance is running. Kill old one:
+```bash
+# On VPS
+fuser -k 2222/tcp
+```
+
+### SSH auth failing from OpenWrt to TrueNAS
+Dropbear requires explicit key flag:
+```bash
+ssh -i ~/.ssh/id_ed25519 truenas_admin@192.168.2.197
+```
+
+### GPON DMZ target
+GPON DMZ should point to OpenWrt WAN IP: `192.168.0.10` (fixed via MAC reservation)