# TrueNAS Remote Access Cheat Sheet

## Network Layout
```
Internet (90.189.160.148 / mallexxx.duckdns.org)
    └── GPON Router (192.168.0.1) — Rostelecom, Realtek-based
            ├── OpenWrt (192.168.0.11) — WAN, acts as main router
            │       └── TrueNAS (192.168.2.197)
            └── ZONT heating controller (192.168.0.10)
```

## VPS
- IP: `91.207.28.205`
- Tunnel user: `tun` (shell `/bin/false`, key auth only)

---

## Method 1 — Reverse SSH Tunnel via VPS (primary)

### How it works
TrueNAS dials out to VPS, VPS exposes port 2222 → TrueNAS SSH.

### TrueNAS script
`/mnt/RED_2TB/system/tunnel.sh` — runs on boot via Init/Shutdown Scripts.

### Connect to TrueNAS
```bash
ssh -p 2222 truenas_admin@91.207.28.205
```

### Enable/disable access on VPS
```bash
passwd -u tun   # enable
passwd -l tun   # disable
```

### Start tunnel manually (if not running)
```bash
# On TrueNAS shell (as root)
sudo bash /mnt/RED_2TB/system/tunnel.sh &
```

### Check tunnel is active on VPS
```bash
ss -tlnp | grep 2222
```

### Check tunnel connection from TrueNAS
```bash
ss -tnp | grep 91.207.28.205
```

### Kill all VPS SSH sessions after delay
```bash
(sleep 600 && pkill -f "ssh.*91.207.28.205") &
```

---

## Method 2 — Access GPON Router UI remotely

### How it works
OpenWrt → reverse tunnel to VPS → forward to GPON UI (192.168.0.1:80)

### Step 1 — On OpenWrt, open reverse tunnel to VPS
```bash
ssh -i ~/.ssh/id_ed25519 -N -R 8081:192.168.0.1:80 root@91.207.28.205
```

### Step 2 — On your machine, forward locally
```bash
ssh -L 9091:localhost:8081 root@91.207.28.205
```

### Step 3 — Open in browser
```
http://localhost:9091
```

---

## Method 3 — Access TrueNAS Web UI remotely

TrueNAS blocks TCP forwarding (`administratively prohibited`), so direct port forward through TrueNAS SSH doesn't work.

### Workaround via OpenWrt
```bash
# On OpenWrt
ssh -i ~/.ssh/id_ed25519 -N -R 8082:192.168.2.197:80 root@91.207.28.205

# On your machine
ssh -L 9092:localhost:8082 root@91.207.28.205
```
Then open `http://localhost:9092`

---

## OpenWrt SSH access
```bash
# Direct (local network)
ssh root@192.168.2.2

# Via TrueNAS tunnel
ssh -p 2222 truenas_admin@91.207.28.205
# then: ssh root@192.168.2.2
```

OpenWrt uses **dropbear** SSH client — no `-v` flag, use `-i` for key:
```bash
ssh -i ~/.ssh/id_ed25519 user@host
```

---

## TrueNAS Notes

### Init/Shutdown Scripts
```bash
# List all scripts
midclt call initshutdownscript.query

# Add new script
midclt call initshutdownscript.create '{"command":"bash /path/to/script.sh &","type":"COMMAND","when":"POSTINIT","enabled":true,"timeout":10}'
```

### SSH authorized keys
```bash
# View
midclt call user.query | python3 -c "import sys,json; users=json.load(sys.stdin); [print(u['sshpubkey']) for u in users if u['username']=='truenas_admin']"

# Update (replace all keys)
midclt call user.update 70 '{"sshpubkey":"key1\nkey2\nkey3"}'

# truenas_admin user ID: 70
# authorized_keys file: /home/truenas_admin/.ssh/authorized_keys
```

### TrueNAS shells
- **Shell 6** — TrueNAS CLI (own interface, limited commands)
- **Shell 7** — Linux bash (full commands, use this for SSH/scripts)

---

## DuckDNS / External Access (mallexxx.duckdns.org)

### Verify DNS matches public IP
```bash
curl ifconfig.me
nslookup mallexxx.duckdns.org
```

### Test port reachability from outside
```bash
nc -zv 90.189.160.148 80
nc -zv 90.189.160.148 443
nc -zv 90.189.160.148 22
```

### Port forwarding on OpenWrt
```bash
uci show firewall | grep redirect
```

Key services:
| Service | External port | Internal |
|---|---|---|
| TrueNAS SSH | 22 | 192.168.2.197:22 |
| Caddy HTTP | 80 | 192.168.2.197:8088 |
| Caddy HTTPS | 443 | 192.168.2.197:8443 |
| MQTT | 1883 | 192.168.2.197:1883 |
| Transmission | 51413 | 192.168.2.197:51413 |

---

## VPS sshd_config (relevant settings)
```
GatewayPorts yes
AllowTcpForwarding yes
PermitRootLogin yes
```
Reload after changes: `systemctl reload sshd`

---

## Troubleshooting

### Tunnel not connecting after reboot
1. Check script exists: `cat /mnt/RED_2TB/system/tunnel.sh`
2. Check Init/Shutdown script: `midclt call initshutdownscript.query`
3. Start manually: `sudo bash /mnt/RED_2TB/system/tunnel.sh &`
4. Check tun user is unlocked on VPS: `passwd -u tun`

### Port 2222 already in use on VPS
Another tunnel instance is running. Kill old one:
```bash
# On VPS
fuser -k 2222/tcp
```

### SSH auth failing from OpenWrt to TrueNAS
Dropbear requires explicit key flag:
```bash
ssh -i ~/.ssh/id_ed25519 truenas_admin@192.168.2.197
```

### GPON DMZ target
GPON DMZ should point to OpenWrt WAN IP: `192.168.0.10` (fixed via MAC reservation)