Firewall (How to Hypervise?)

I moved from a Proxmox hosted TrueNAS Core to Scale on bare metal mainly due to the support for VMs and Kubernetes. In my situation, the NAS is in my house behind a robust firewall and not directly exposed. So, my situation is a little different than yours.

That said, if I were to build it again, I would likely go the route of Proxmox first. TrueNAS does have limitations that admittedly get better with each new release, but, it is first and foremost a NAS. Proxmox exposes a lot of functionality in terms of networking and VM hosting that TrueNAS hides from you; not to mention it is much more permissive about installing software on the base system.

If I were attempting to run a server at a datacenter where I didn’t have direct access in the event something goes wrong, I’d want some of those Proxmox features like VM snapshots and vnc/shell access when updating things (like TrueNAS). Yes, I know some datacenters offer that kind of access to the appliance, but that comes down to your comfort level with these tools.

Of course, these are my opinions and I’m sure there are good reasons for going in the other direction. It really depends on how mission critical your installation is.

1 Like

well that’s literally what I want to do! :hugs:

So just to clarify - when I said exposed, I meant exposed at all - as opposed to being 100% locked. This is a NAS I am building currently so, setup is open to modifications. I do need to ‘expose’ port 80/443, but this will be again locked to only my IP, so … it will actually be pretty locked down… VM’s on the other hand need more ports open, for each service, so this is where my datacenter firewall fails short (I will still use it to lock down everything on the scale server itself, other than allow me access from my vpn ip).

yeah. with proxmox I would not be even poundering this question at all, as proxmox has a firewall built in…

somehow I have this weird idea, that replication between two truenas servers, or just disk access would work better / more reliable / more stable if I use truenas scale on bare metal… but I kinda also feel that proxmox is probbably a smarter choice in fact.

But, question - what is the complication if you put truenas scale as a vm in proxmox? what are the issues here? I would like to have truenas be the main point where all my data lies, so that I can have a replication setup with my home server (I do have another home server actually that is truenas baremetal), so that I can have a copy of all my data basically if a meteor hits the datacenter :rofl: or something like that…

what is the disk layer proxmox uses? I know I can pass iSCI as disks to the proxmox, but this saturates the NIC chipset right? the OS itself I guss would obviously need to have bare metal disks, so I loose nvmes in this case for proxmox instalation itself…

thanks for your insight

btw I just found your youtube chanel ! Great work!

1 Like

FWIW I’ve been virtualizing my pfsense box inside of TrueNAS SCALE for a few years now. I just pass thru the NIC and otherwise it’s not anything special vs a normal VM.

I was previously a VMUG subscriber and had used TrueNAS just for iSCSi. This is definitely simpler to manage. But ofcourse as @Stux already mentioned, if you have to do maintenance on TrueNAS you have to take a network outage, in my case only after receiving the WAF (Wife Acceptance Factor).

Also, as annoyed as I am with Netgate, I am still very much a pfsense fanboi.

1 Like

I had found that, when I wanted to start replacing disks to grow the size of TrueNAS’s zfs pool, it required a bit of reconfiguration in Proxmox to pass the new physical disks through. The complication here is that, you tend to forget what you originally did when you finally get around to something like that.

You’d lose one for the TrueNAS installation. The big difference is that Proxmox can share that disk with your VMs. With TrueNAS, you can’t, so I feel a lot of disk gets wasted (with the caveat that you can probably size this better with a hosted appliance than say, the SSD I put in mine). You could run Proxmox on an NVMe disk that also has a partition or space for your TrueNAS OS virtual disk.

I guess that’s another complication. In that, the VMs and docker apps on TrueNAS get that easy built-in access to the pool. Any VM you put on Proxmox will require some “network” disk access such as iSCSI or NFS if you want it to have access to your TrueNAS storage. I never dug that deep into this, but I want to say that that traffic passes through the kernel/cpu, and wouldn’t necessarily hit your NIC unless it was headed off-server.

Just a quick reply I just found out that actually TrueNAS has been historically based on MonoWall which was a FIREWALL

haha LOL