TerraMaster Forum

TOS 5.1.131-00123 (if I need to upgrade it will be online from now on)

My eventual aim - to use it as a slightly fancier DAS, no external internet access, separate wired network with another unit in the shed as 2nd backup.

I only use Linux, I am not a networking newbie (thought I don't count myself as an expert either).

I've temporarily got it hooked into my main network with no data on it and in "Security Isolation Mode"

Is there something strange about the network ports? I have one on my main network, and one on a small isolated network (running a DHCP server via a managed switch)

ping: tnas-25d9.local: Name or service not known
john@john-All-Series:~$ sudo nmap -sP 10.0.0.12
[sudo] password for john:
Starting Nmap 7.80 ( https://nmap.org ) at 2024-06-21 11:51 BST
Nmap scan report for 10.0.0.12
Host is up (0.000091s latency).
MAC Address: 6C:BF:B5:03:25:DA (Noon Technology)
Nmap done: 1 IP address (1 host up) scanned in 13.10 seconds
john@john-All-Series:~$ sudo nmap -sP 192.168.1.5
Starting Nmap 7.80 ( https://nmap.org ) at 2024-06-21 11:52 BST
Nmap scan report for 192.168.1.5
Host is up (0.00015s latency).
MAC Address: 6C:BF:B5:03:25:D9 (Noon Technology)
Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds
john@john-All-Series:~$ ping 10.0.0.12
PING 10.0.0.12 (10.0.0.12) 56(84) bytes of data.
^C
--- 10.0.0.12 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3066ms

john@john-All-Series:~$ ping 192.168.1.5
PING 192.168.1.5 (192.168.1.5) 56(84) bytes of data.
64 bytes from 192.168.1.5: icmp_seq=1 ttl=64 time=0.193 ms
64 bytes from 192.168.1.5: icmp_seq=2 ttl=64 time=0.194 ms
^Z
[1]+ Stopped ping 192.168.1.5
john@john-All-Series:~$

I can identify both network sockets on the TNAS via nmap, via the MAC addresses (which I pulled off the unit) - but I can only ping and get the web interface up on one of them.

Q1. why does only one of the network interfaces seem active for web interface and ping? Is this anything to do with which is the "default gateway"?

Q2. its been "Synchronizing" for 11 hours (it quoted 31 hours for 6x 12TB BTRFS) - yet the progress is still 0% - is this "normal"?

Thanks in advance, John.

Q2 update - turns out I can pull the current synchronizing status via web interface, its actually ~31% so that's OK. Not sure why it does not show that on the status info from the drop down though.

(also I can understand time limiting posts to this forum, but that makes no sense to the OP of any thread as they will need to respond to other posts/answers)

I suspect the 'security isolation mode' is not working as you might expect. Typically this appears to stop all network traffic to and from the nas.

How many networks are your TNAS connected to? Are 10.0.0.12 and 192.168.1.5 in two different isolated networks? What is the network condition of TNAS connection when security isolation mode is enabled?

jlloyd28564932 wrote: ↑21 Jun 2024, 19:09
Q2. its been "Synchronizing" for 11 hours (it quoted 31 hours for 6x 12TB BTRFS) - yet the progress is still 0% - is this "normal"?

It is NOT normal.
Please restart your device and observe again. If the problem persists, please check if one of the hard drives is faulty. In addition, please ensure that the hard drives are properly installed, and you can also try swapping the positions of the two hard drives.

By the way, what is your model number?

@TMroy

Ignore Q2 - that's not an issue. That's a clear bug in the TOS5 where the status is not reported correctly, see photo. If you go into the Control Panel->Storage Pool you can see the true status (90.8%) whilst the dropdown System Info always seems to show zero. Slightly annoying but not serious at all.



For Q1 they are two unrelated networks. I am able to use the 192.168 network just fine in security isolation mode - both are local networks only running from DHCP servers in my house - ie. independay cabling. But only one can see the outside world. The 10.0 network claims to be fine (and I can see from the DHCP logs that it has correctly claimed an address via MAC address) - but it does not reply to ping or serve the webpage

So http://192.168.1.5/tos/#/ works, whilst http://10.0.0.12/tos/#/ does not.

(I'm still being slightly cautious still as the terramaster network ports are my only method of access currently - hence I don't want to change it to static IP until I have a second input. I'm assuming it runs some *nix internally, and the main user account can log in and is in sudoers, so I'm getting the cabling to plug it into my big KVM switch then I can save myself via /etc/network/interfaces if I do anything stupid and lock myself out via network)

@gremlin

The security isolation mode merely shuts of access to the outside world, this is by far my preferable mode of operation - even on an internal network only. The more barriers you put up the better your security is. I don't mind about not having ssh access if I can use my kvm switch to get a console access.

Of course I considered installing my own OS but decided against it as I don't know what work has going into TOS to handle things like cooling fan control and what not.

jlloyd28564932 wrote: ↑22 Jun 2024, 18:03
@gremlin

The security isolation mode merely shuts of access to the outside world, this is by far my preferable mode of operation - even on an internal network only. The more barriers you put up the better your security is. I don't mind about not having ssh access if I can use my kvm switch to get a console access.

Of course I considered installing my own OS but decided against it as I don't know what work has going into TOS to handle things like cooling fan control and what not.

If you want things to work in your own manner then seriously consider installing your own OS. AFter issues with ransomware in TOS4, TM basically took a technical sledge hammer to the permissions (including removing root user) and the IP Tables. imo it has to be considered as strictly TOS and not Linux (despite the kernel). For one thing regarding your setup, there is no routing function incorporated in TOS. The 'active' network may depend which is attached to eth0 (LAN1) - one of the 'rules' for installing TOS is that only eth0 be connected until install is complete. Hope you get it sorted.

"The 'active' network may depend which is attached to eth0 (LAN1) - one of the 'rules' for installing TOS is that only eth0 be connected until install is complete. Hope you get it sorted."

TBH this has been my suspicion - yes there are two 2.5GBe but I suspect you cannot make them fully independent. That's OK for my aims though, its only on the 192. (external) network until everything is setup - after that it won't ever see the outside world again and will be a glorified storage box that I can see from a few PCs only.

Nothing is truly secure - but you can to the legwork to make sure you're not the low hanging fruit, right? Even on an internal network my PC could still be compromised etc etc

Gremlin wrote: ↑22 Jun 2024, 19:55

jlloyd28564932 wrote: ↑22 Jun 2024, 18:03
@gremlin

The security isolation mode merely shuts of access to the outside world, this is by far my preferable mode of operation - even on an internal network only. The more barriers you put up the better your security is. I don't mind about not having ssh access if I can use my kvm switch to get a console access.

Of course I considered installing my own OS but decided against it as I don't know what work has going into TOS to handle things like cooling fan control and what not.

If you want things to work in your own manner then seriously consider installing your own OS. AFter issues with ransomware in TOS4, TM basically took a technical sledge hammer to the permissions (including removing root user) and the IP Tables. imo it has to be considered as strictly TOS and not Linux (despite the kernel). For one thing regarding your setup, there is no routing function incorporated in TOS. The 'active' network may depend which is attached to eth0 (LAN1) - one of the 'rules' for installing TOS is that only eth0 be connected until install is complete. Hope you get it sorted.

root user *should* be removed IMHO - need higher permissions? use sudo in limited context.

jlloyd28564932 wrote: ↑22 Jun 2024, 21:19

When you initialize your TNAS, the network you use will become your default network, such as eth0, 192.168.1.x. Once you enable the secure isolation mode, access from devices with other network addresses will be denied, except for those within the default network.

By the way, TOS currently does not have multi-routing functionality.