Hi all,
I’m getting started with TrueNAS Scale and so far I’m quite happy. I have TrueNAS running behind a reverse proxy and the proxy → nas traffic goes over HTTPS. However, if it is possible I would like to enable mutual TLS, such that only authorized clients can talk to the nas. Is this supported and if so, how do I enable it?
Doesn’t this belong in your reverse proxy configuration?
It does, and I use it as an additional layer to secure client → proxy traffic. However, as I’m big on zero trust I would also like to secure the proxy → nas traffic with mTLS as well. In case of unauthorized network access (be it through the compromise of a different service or physical access to a patch panel) this prevents unauthorized access to the nas.
To clarify; the proxy presents certificates that can be used for mTLS. It is up to the backend (TrueNAS in this case) to actually verify the provided client certificate and reject connections that fail the verification or do not present a certificate at all.
I understand. No idea, sorry.
I intentionally keep the connection from reverse proxy to applications unencrypted in my home network.
I think you could achieve that either by using self signed certs(probably not that sexy) or by using the ACME clients.
But similar to pmh, I think that in a properly configured VLAN, this is probably a waste of CPU cycles.
Something else I don’t understand, why would you want to reach the TrueNAS GUI over a proxy instead of directly? You are not publishing the webGUI to the internet, are you?
Currently, all the internal network traffic utilizes certificates signed by the root CA that lives inside a HSM. All external traffic uses ACME which is terminated at the proxy, which in turn re-encrypts the traffic for internal distribution.
I do want to be able to reach the TrueNAS GUI over the internet with proper access control in place 
In my case that is mTLS between the client and the proxy as well as an IP whitelist in the proxy (which will only include the VPN private address). Plenty of layer there.
The thing I want to achieve is that only GUI traffic from the proxy (critical node in the network) is accepted by TrueNAS (through mTLS). I do keep TrueNAS in a separate VLAN, but other services must access the data (SMB shares) so there is a connection there. I do have firewall rules in place that only allow HTTPS traffic from the proxy VLAN and SMB traffic from specified services that need it. But to me it seems like a no-brainer to enable mTLS internally if it is there. All the certificates are already there to provide HTTPS connections, so why not verify both ends? Defence in depth right?
It would be great if TrueNAS did support mTLS. You could create a feature request.
Feature request made.
