I was exiting to see that TrueNAS SCALE included ACME DNS-Authenticator. However, iXsystems chose to only include Cloudflare and route53 (aka AWS) DNS API was some what a disappointment. Cloudflare and route53 are not really a popular domain providers for personal use. Although Cloudfare is more affordable compare to AWS, it's still more expensive than most domain provider. I don't see any reason not to include all the DNS API already supported by ACME shell script. Even pfSense included all DNS API in pfSense + (pfSense paid product). For full list of DNS API supported by AMCE shell script, please visit amce.sh official page: https://github.com/acmesh-official/acme.sh/wiki/dnsapi

You can watch the tutorial on YouTube for more detailed instruction:

The first step is to update your network setting. Under Network > Global Configuration. You can change your Hostname and Domain from here. By default, domain name is set as local. You will need to change it to a Fully Qualified Domain Name (FQDN) as shown below:

You would need to restart your system for the Hostname change and domain name change to take effect. Once your TrueNAS restarted, the next step is to install the acme.sh shell script using the below command:

curl https://get.acme.sh | sh -s email=xxxxxx@xxxxx.xxx

Use the ACME DNS API wiki to determine what the correct syntax for your Domain service provider:

https://github.com/acmesh-official/acme.sh/wiki/dnsapi

The syntax below is for ClouDNS API

# Use this for a sub auth ID
export CLOUDNS_SUB_AUTH_ID="XXXXX"
# Use this for a regular auth ID
export CLOUDNS_AUTH_ID="XXXXX"
export CLOUDNS_AUTH_PASSWORD="YYYYYYYYY"

Make sure to put the credential in the quotation mark " "

The next step is to request a certificate from Let's Encrypt server by using the below command:

acme.sh --issue --dns dns_your --keylength 4096 -d truenasscale.sysadmin102.tech

Replace dns_your with your DNS API listed on the ACME Wiki. You can skipped the --keylength 4096 if you wish toy use the default setting

If everything runs smoothly, you screen should have something similar to the screenshot below:

Next, you will need to generate a API Key on TrueNAS to deploy the certificate.

After you generate the API Key, copy it, we will need it to deploy the certs on TrueNAS

You will need the python script written by a user named danb35@TrueNAS to deploy the certificate. You will clone his certificate to your TrueNAS using the command below:

git clone https://github.com/danb35/deploy-freenas

Once you've downloaded the script, you'll need to create a configuration file called deploy_config. The git repo has an example (deploy_config.example) which you can copy and modify, or you can write your own from scratch.

Open the deploy_config.example and save as deploy_config using nano text editor.

Remove the # in front of api_key and add the API key that you generated earlier

Add # in front of password = YourSuperSecurePassword#@#$* to disable the password option.

Next, you will deploy the certificate using the below command:

acme.sh --install-cert -d truenasscale102.tech --reloadcmd "~/deploy-freenas/deploy_freenas.py"

Once the command is successfully ran, you will get the message "Certificate import successfully." Your Web Service will restart.

Log in after the system restarted. Then, navigate to System Settings > GUI > Settings and enable Web Interface HTTP -> HTTPS Redirect.

The system will restart Web Service, once it restarted, you will no longer see the red line over the lock icon because your certificate is signed by ZeroSSL.

Lastly, you need to create a Cron Job to renew the certificate automatically. Navigate to the System Settings > Advanced > Add. Disregard the Warning message by selecting "Close."

Under the description box: enter whatever describe the job. Under the command enter the below command:

/root/.acme.sh/acme.sh --cron

Congratulation, you have successfully deployed Let's encrypt Certificate on your TrueNAS.

Official ACME Github: https://github.com/acmesh-official/acme.sh

Official ACME DNS API Wiki: https://github.com/acmesh-official/acme.sh/wiki/dnsapi

Credit to danb35@TrueNAS. Link to the original post: https://www.truenas.com/community/resources/lets-encrypt-with-freenas-11-1-and-later.82/

In this tutorial, I will show you how to obtain an SSL Certificate for your Nextcloud plugin on TrueNAS using Certbot. This is a very detailed tutorial, so it's lengthy. Please don't skip the step unless you know what you doing. You have been warned!

Here is the video version for this tutorial, if you don't like reading :)

https://www.youtube.com/watch?v=TENMMSbtJY4

Before you can request SSL Certificates from Let's Encrypt, you will need to have a DDNS or subdomain in place. If you don't know how to, you can follow my tutorial or any tutorials available on the Internet (this is why I love the Open-source community. We share everything #Opensource). You will also need to set up Port Forwarding so that the Let's Encrypt server can reach your Nextcloud jail and Nextcloud is accessible from outside of your LAN network. There are plenty of tutorials on this, so I won't go over Port Forwarding or DDNS.

https://www.youtube.com/watch?v=Kdb7cQpWDuU

The first step is to install Nextcloud from the Offical plugins on TrueNAS:

We will use static IP as we want the IP remains the same for our Nextcloud server. Save the setting after you provide the Jail Name, select IPv4 Interface, provide the IPv4 Address and IPv4 Network Subnet Mask.

Once the installation complete, you can close the Install Notes.

Access the Admin portal by copying and pasting the address to your web browser or clicking on the MANAGE button.

You may get a "Warning from your browser as Nextcloud is using a self-signed certificate." For most browsers, you can select Advanced, accept the risk and continue

In early October 2021, TrueNAS announced a partnership with Nextcloud to provide an officially supported integration with TrueNAS. The plugin installation scripts now install Cerrbot and automatically generate a self-signed certificate for HTTPS straight out of the box.

Depending on your network setting and as well as the platform you run TrueNAS on, you may get the error Access through an untrusted domain. This is an easy fix. You will need to establish an SSH connection to TrueNAS jail to modify the config.php file. Follow the video below if you are having trouble accessing Nextcloud jail via SSH:

To access TrueNAS Jail, use the below command, followed by your jail's name. In this tutorial, nc is the name for my Nextcloud jail.

iocage console

Easy Editor is a text editor that comes preinstalled on FreeBSD. However, you can you vim, vi, or nano; whatever will get the job done. It's a good practice to make a copy of the original config file before making any changes. If you make a mistake, at least you still have a copy of the original file.

Use the command below to make a copy of your config.php:

cp /usr/local/www/nextcloud/config/config.php /usr/local/www/nextcloud/config/original_config.php

Now, we can edit config.php file using Easy Editor (ee):

ee /usr/local/www/nextcloud/config/config.php

Navigate up or down, left or right by using the arrow key until you find 'trusted_domains' block. Using the same format, add or edit your IPv4 address to match your Nextcloud IPv4 address. If you already had a Fully Qualified Domain Name (FQDN), you can also add it here. If not, you can come back add it once you acquire one.

Once you finish editing the config.php, Press Esc key to return to the main menu. Press Enter or a key to leave the editor and save changes.

You can now access your Nexcloud login page:

Log in using the user name and password provided under the Post Install Notes. As good security practice, you change the Admin default User/Password once you log on. However, we will skip this step and come back to this later on after we obtain the SSL certificate from Let's Encrypt.

As I mentioned, Certbot is preinstalled in Nexcloud jail. However, it would make things a lot smoother if whoever maintaining the plugin added the nginx plugin for Certbot. I have modified the command to better suit Jail environment, but all credits go to the original author Mark Drake @ DigitalOcean. https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-letsencrypt-freebsd

To begin, fetch a compressed snapshot of the ports tree:

portsnap fetch

It may take a few minutes for this command to complete. When it finishes, extract the snapshot:

portsnap extract

It may take a while, so you can relax and get a cup of tea or coffee. I prefer tea, as for some odd reasons, coffee makes me fall asleep (no kidding ;).

Next, navigate to the py-certbot-nginx directory within the ports tree:

cd /usr/ports/security/py-certbot-nginx

Run the make command from this directory. This will install the nginx plugin for Certbot which we’ll use to obtain the SSL certificates:

make install clean

During this plugin’s installation, you will see a couple of blue dialog windows pop up that looks like this:

These give you the option to install documentation for the plugin and its dependencies. For the purposes of this tutorial, you can just press Enter to accept the default options in these windows which will install this documentation.

Again, this tutorial assumed that your firewall/router/port forwarding/DDNS settings were already configured and allowed port 443 to reach your Nextcloud jail. If you’ve already set them up, you can move forward to the next step.

Certbot provides a variety of ways to obtain SSL certificates through various plugins. The nginx plugin will take care of reconfiguring Nginx and reloading the config file:

certbot --nginx -d example.com

Enter an email address (used for urgent renewal and security notices).

Accept Terms of Service and Decline to share your email (it's up to you if you want to share your email).

If you received the below error, check your network setting (Firewall/Port Forwarding/DDNS) to make sure port 80/443 is accessible from Nextcloud jail and from outside your LAN network.

If you have done everything correctly, your certificates are now downloaded, installed, and configured.

Let’s Encrypt’s certificates are only valid for ninety days. This is to encourage users to automate their certificate renewal process. This step describes how to automate certificate renewal by setting up a cron task. Before setting up this automatic renewal though, it’s important to test that you’re able to renew certificates correctly.

To test the renewal process, you can do a dry run with Certbot:

certbot renew --dry-run

If you see no errors, you’re all set to create a new crontab:

crontab -e

This will open a new crontab file. This is a vi text editor, press I to enter insert mode and navigate to the end of renew_certificates. Press Enter and add the following content to the new file, which will tell cron to run the certbot renew command twice every day at noon and midnight. certbot renew checks whether any certificates on the system are close to expiring and will attempt to renew them when necessary:

0 0,12 * * * /usr/local/bin/certbot renew

Press Esc to terminate the insert mode. Press Shift + ZZ to save the file and quit.

If the automated renewal process ever fails, Let’s Encrypt will send a message to the email you specified, warning you when your certificate is about to expire.

We are not done yet! If you try to access your Nextcloud using FQDN, you will receive "ERR_TOO_MANY_REDIRECTS" message. That is because Certbot automatically added server settings to your config file. Don't panic yet, we will fix it!

Your certificate is saved at:

/usr/local/etc/letsencrypt/live/example.com/fullchain.pem

Key is saved at:

/usr/local/etc/letsencrypt/live/example.com/privkey.pem

Trusted certificate is saved at:

/usr/local/etc/letsencrypt/live/example.com/chain.pem

Open your nginx.config file using the below command:

ee /usr/local/etc/nginx/nginx.conf

Change the path to the letencrypt folder where your certificate, key, and trusted certificate are saved.

*Hint: you only need to replace truenas with your example.com.

You will have something similar to the below screenshot:

Test the changes by restarting the nginx service:

service nginx restart

At this point, you shouldn't be able to access your Nextcloud yet when you try to refresh your browser. Changing nginx.config file required a restart of Nextcloud jail to take effect.

Refresh your browser after you restart Nextcloud jail. If you have done everything correctly, you should be able to access your Nextcloud login portal at this point:

Notice the SSL icon is no longer red because your server is now using a certificate issued by Let's Encrypt:

Congratulation! You have successfully installed and obtained an SSL certificate for your Nextcloud server. You can follow this tutorial to enable 2 Factor Authentication (2FA) to add another security layer.

Again, special thanks to Mark Drake @ DigitalOcean.

If you think the tutorial is helpful, don't forget to subscribe to my social media channel. If you link my tutorial to another site, please at least give proper credit; everyone seems to steal others' ideas now a day :(.

And remember:

while(!(succeed = try()))

In this post, I will show you how to install pfSense as a Virtual Machine (VM) on ESXi 7.0. We will take a look at the hardware setup and the network diagram before we go over the installation process.

I run ESXi on the Dell R620 that equipped with Broadcom® 5720 Quad-Port GbE Rack Network Daughter Card (NDC) 1G BASE-T . I purchased an additional PCI-E NIC Dell Intel Ethernet I350 Dual Port 1Gb Server Adapter Low Profile and installed on Dell R620 PCI-E Slot. This will be a dedicated NIC for pfSense VM, which will be operating in passthrough mode in ESXi. Below is the network diagram:

I will use class A address for my LAN subnet 10.13.2.0/23 ( Subnet Mask /23 or 255.255.254.0). When creating a LAN subnet, you should choose a unique numbering that not commonly used as a default subnet on many routers in public places such as 10.0.0.0/24 or 192.168.0.0/24. If you decide to host an OpenVPN server on your pfSense VM, having the same subnet as where you would remotely tunnel into your home network, cross-site IP numbering conflicting is expected. For instance, suppose you use the popular 192.168.0.0/24 as your private LAN subnet. Now you are trying to connect to the VPN from an internet cafe which is using the same subnet for its WiFi LAN. You will have a routing conflict because your machine won’t know if 192.168.0.1 refers to the local WiFi gateway or to the same address on the VPN. I will use my AmpliFi Alien Wifi 6 Wireless Router in Bridge Mode as my Wireless Access Point (WAP).

The first step to create a VM on ESXi is to obtain the OS image (ISO file) from pfSense and upload it to ESXi Datastore. pfSense ISO file can be downloaded from the official site: https://www.pfsense.org/download/. You will select the AMD64 (64 bit) architecture. Netgate ADI is for Netgate Device only such as the SG-5100 Security Gateway or XG-7100 1U Security Gateway.

Before we begin creating the VM, we will toggle passthrough for the Dell Intel Ethernet I350 Dual Port. This will enable us to use the physical adapter with pfSense VM instead of using VM Network Adapter.

Next, we will create a new VM by clicking on Virtual Machine > Create/ Register VM. According to Netgate Documents, pfSense version 2.4.x under lying OS is FreeBSD 11 (64 bit), so we will choose Guest OS family as Other and Guest OS Version as FreeBSD 11 (64 bit).

For the hardware setting, it really depends on the current system that you run your ESXi on and what kind of services you will be running on your pfSense. I'll leave this to you to decide as you can always go back and change it later on. I will use OpenVPN and traffic filters on my pfSense so 4 CPUs with 16GB of RAM (16GB for Reservation) and 16GB Hard Disk would be more than sufficient to run pfSense. We will remove the USB controller and Network Adapter as we do not need them. The next step is to mount the ISO file. You will click on Host device and select Datastore ISO file and navigate to the location where you upload the ISO file. Lastly, We will add the Dell I350 Ethernet by selecting Add other device > PCI device. We will repeat the same step to add the dual ports to pfSense VM.

Before we power on the VM, we will click on Actions > Autostart > Enable, to ensure that the VM will automatically start everything ESXi rebooting.

After you power on the machine, just follow on screen instruction to install pfSense. Once the VM rebooted, we will assign the interface for WAN/LAN

We will not be setting up VLAN, this can be done later using the webConfigurator. Response N for "No" when prompted. We will use auto detection to assign WAN/LAN. pfSense will assign the interface with link status "UP" as WAN. You can repeat the same step to assign LAN or choose the remain interface as LAN.

Next, we will set the interface IP address to our unique LAN subnet 10.13.2.0/23 by selecting option 2 and interface 2 for LAN. I will enter 10.13.2.1/23 when prompted for IPv4 address. We will skip IPv6 as it can be config later on webConfigurator. We will Enable DHCP Server on LAN. The IP range will be 10.13.2.0 -10.13.2.199.

Once pfSense reload, we will be able to access the webConfiguration @ http://10.13.2.1/. The default login user name is admin and the password is pfsense. pfSense setup wizard will guide you through the initial configuration of pfSense.

You can change the Hostname/Domain or keep it as default. You can choose which DNS server to use or keep default setting and received the DNS server from your ISP.

Step 3 is setting up Time server hostname and Timezone. You can change it to the time server that you refer or keep it as default. Select the correct Time Zone for your area. You can skip Step 4 as most of us have DHCP as default for WAN setting. Step 5, you can change the LAN subnet or keep it as the one we have previously set. Step 6 is to change the Admin password. Step 7 is to reload pfSense with new changes.

Congratulation! You have successfully configured pfSense router.

In this tutorial, I will show you how to config Dynamic DNS(DDNS) on TrueNAS with ClouDNS. Although this tutorial is written for TrueNAS, it also works on FreeNAS 11.3 and as well as the older versions.

What is Dynamic DNS?

Dynamic DNS, or DDNS for short, is a DNS service that provides the option to change the IP addresses of your A/AAAA records when the IP address of your device is changed dynamically by your Internet Service Provider. This is a good solution especially for home networks, which typically have dynamic public IP addresses from their ISP.

How do I setup a Dynamic DNS?

If you do not have a domain already, you can register for one at an affordable price at ClouDNS or you use the free subdomain offers by CloudDNS. The first step is to log in your ClouDNS at: https://www.cloudns.net. If you already have a domain name, you can easily create a Master DNS zone for your domain in a few clicks. From DNS Zones panel, click on Add new button. Input your domain name, keep the default options (you can add records later) and click on Create button. As shown in the below screenshot, sysadmin102.tech is a Master DNS Zone.

Click on sysadmin102.tech to acess DNS Zone Management Page. Since Dynamic DNS is a feature that allows an automatic update of your A records, you need to add such. To do so, at your DNS zone management page, click on the Add new record link. For Type choose A and type as follows:

I named the host as ddns for demonstration purpose. You should change it to your specific host. If you have static IP address you can set to point to your IP address (you properly don't need DDNS if you have static IP address). If you have a Dynamic IP address (IP Address may change at any time), use the private IP address 198.168.1.1. Once we config the DDNS on TrueNAS, it will automatically update the A record to reflect your public IP address. This way you will know if the DDNS service is actually running on TrueNAS.

To activate Dynamic DNS, at your DNS zone management page, find the A/AAAA record(s), you want this service to be activated on, and click on the up and down arrows icon (Active Dynamic URL). Once, you've clicked on it, a new window will pop up, which will prompt you to activate the service.

We will not use Dynamic DNS under Services on TrueNAS as it's potential security risk. We will use Cron Job to protect the ClouDNS user name and password. From TrueNAS web interface, click on Tasks button. Next click on Cron Jobs tab and click on Add Cron Job button.

For the description block, I will name this Cron Job as DDNS. For the Command block, paste the Wget command that you have copied from the Dynamic URL window. For the Run As User block, select root. For the Schedule drop down, select hourly to match with A record TTL. Click on Submit button to create a Cron Job.

Once you add the Cron Job, I recommend to click on it in the Cron Job list and then click on Run Now button on the bottom of the page in order to execute it instantly. Now, go back to ClouDNS and refresh the page. If you follow the step correctly, your A record will point to your Public IP address instead of the private IP address 192.168.1.1.

Congratulation! You have successfully config DDNS for your TrueNAS. Don't forget to check out my YouTube channel for more tutorial