Intruders can do a lot more than take stuff files/data from your server, here’s a short list, they can:
- use it as springboard into the rest of your network
- use it to mine cryptocurrency
- use it in a “bot net” to attack others, sort of making you complicit
- put stuff on your server that you may not want to be associated with
Rudimentary protection from outside threats has been included in every consumer router I have ever dealt with and it would take manual effort from someone to disable or sidestep that. It comes in the form of Network Address Translation, or NAT for short. I think it’s fair to say that it’s a standard feature and has been for a generation or more.
A simplified explanation follows
Most routers have a WAN/Internet port that gets an outward facing IP. Whether or not that IP is publicly accessible depends on your Internet Service Provider (ISP).
Your other gear should be connected to the LAN ports. The LAN is your internal network.
Network traffic intended to reach the outside from say, your computer, goes into the router through the LAN ports, routing magic happens, and the data gets sent out through the WAN port to your ISP. Responses go back the same path. This works because your router keeps tidy records on which IP’s you’re currently communicating with. There’s also a time aspect. Just because your computer communicated once with a certain IP an hour ago doesn’t mean that IP gets a free pass forever and ever.
If an outside IP tries to initiate a connection that your router can’t link to an already established still ongoing link, the router will dismiss or drop it, because it’s clearly invalid, possibly malicious. In short, a sane network will block all incoming traffic unless it can be linked to something a local client has initiated.
Sometimes you may want to allow an outside IP to start the connection. One way to do that is using port forwarding. This tells the router to pass all incoming traffic marked with a certain number (a port) onward to whatever local client IP you picked. Examples of when this comes up is if you want to run a local server.
Another option is to set a system up as a DMZ. This lazily tells the router to pass all traffic onward to a specific IP. In short I will say that this has mostly fallen out of favour. It’s a heavy handed tool of limited use today.
It’s possible you have enabled port forwarding on your router, or you set your TrueNAS server up as the DMZ. Both of these are a bad idea because TrueNAS isn’t hardened to withstand the constant pokes and prods from malicious outside entities.
Lastly, it’s possible you’ve connected your TrueNAS server incorrectly. Many homes have what is called Customer-Premises Equipment (CPE). That gear is sometimes ISP owned and seen as the final point in the ISP:s network infrastructure. You connect your WAN port on your router to the CPE and everything on your network goes through the router’s LAN ports. Never connect anything else to the CPE even if it has multiple “free” ports unless specifically told to do so by your ISP. I would still second guess any ISP telling me to connect my server directly to the CPE, it’s massive security risk. Some ISP’s offer multiple public IPs and it may be compelling to use them, but there are substantial security implications of bypassing NAT for the uninitiated, and great care should be taken when doing it.
The followings could also cause the symptom you experience: