FreeNAS using Active Directory Wiki - User contributions [en]

User:Mauirixxx/pfSense IPSec VPN

2019-07-23T22:48:27Z

Mauirixxx: /* Advanced Options */ formatting

== About ==
How to setup an ipsec vpn between 2 instances of pfsense using both a static (work) and dynamic ip address (home office). However, a static IP is NOT a requirement.

== Software used ==
* pfSense: https://www.pfsense.org

== Requirements ==
* Dynamic '''OR''' static IP address
* A [https://www.namecheap.com/ domain name] or a [https://www.maketecheasier.com/best-dynamic-dns-providers/ free dynamic DNS provider].
* CPU with [https://en.wikipedia.org/wiki/AES_instruction_set AES-NI] (if your uplink is 20Mbps or faster)

== Configuration ==
I'm going to assume that if you're at this point, you already have a working pfSense configuration at both locations.

Both locations must NOT have the same internal LAN address - meaning both can't be running 192.168.1.x addresses, one can run 192.168.1.x while the other can run 192.168.2.x.

Final note - the VPN configuration on both firewalls will be exactly the same, save for parts that require IP addresses or hostnames.

Let's get started:
* Click on VPN -> IPsec, and on the bottom right, click on the green "'''+''' Add P1" button at the bottom of the screen.
=== Phase 1 ===
==== General Info ====
* Key exchange version: IKEv2
* Internet Protocol: IPv4 (IPv6/Dual stack will work if you're running IPv6 at both sites)
* Interface: WAN (or whatever you named the interface with the public IP address)
* Remote Gateway: this is where you need either your own domain, or a free Dynaimc DNS provider - or manually entering the IP addresses works, users with dynamic IP addresses the "work" location will have to update your IP address manually every time it changes.
** Remote Gateway (home): work.piracyforjesus.xyz
** Remote Gateway (work): home.piracyforjesus.xyz
* Description: put whatever you like or leave blank
==== Phase 1 Proposal (Authentication) ====
* Authentication Method: Mutual PSK
* My Identifier: Distinguished name:
** Home: home.piracyforjesus.xyz
** Work: work.piracyforjesus.xyz
* Peer identifier: Distinguished name
** Home: work.piracyforjesus.xyz
** Work: home.piracyforjesus.xyz
* Pre-Shared Key: On one firewall, click generate key, then copy & paste that key to the other firewall

==== Phase 1 Proposal (Encryption Algorithm) ====
* Encryption Algorithm:
** Algorithm: AES128-GCM
** Key Length: 128 bits
** Hash: SHA256
** DH Group: 14 (2048)
* Lifetime (Seconds): 28800
==== Advanced Options ====
Leave everything defaulted in this section, and click Save. When finished, it should look like this:

[[File:Phase1-complete.png]]

=== Phase 2 ===
From the above screen, click on "Show Phase 2 Entries (0)" and expand out the menu, then click on the green "'''+''' Add P2" button that appears.
==== General Information ====
* Mode: Tunnel IPv4
* Local Network: LAN subnet
* NAT/BINAT translation: None
* Remote Network: Network
** Address (Work): 192.168.10.0/24
** Address (Home): 192.168.1.0/24
* Description:
** Home: Work LAN
** Work: Home LAN
==== Phase 2 Proposal (SA/Key Exchange) ====
* Protocol: ESP
* Encryption Algorithms: AES128-GCM @ 128 bits
* Hash Algorithms: AES-XCBC (or SHA256 if your CPU doesn't have AES-NI)
* PFS key group: 14 (2048)
* Lifetime: 3600
==== Advanced Configuration ====
* Automatically ping host: set this IP address to a server you run 24/7, this will keep the VPN up 24/7

After you hit save, this is what your Phase 2 will look like:

[[File:Phase2-complete.png]]
== Firewall Rules ==
After you hit "Apply Changes" on both firewalls, your IPsec VPN should connect right away. You may find that you can't ping anything across the VPN though - you'll need to click on Firewall -> Rules -> Add to create a hole in the firewall to allow traffic to pass.
=== Insecure allow all traffic rule ===
This rule will allow ALL traffic to traverse the firewalls (remember you have to make the same rule for both sides). This is NOT a secure setting! If your home network gets compromised, your home network can be a jumping off point for bots/hackers/viruses to invade the network on the other side of the VPN.

''' You have been warned.'''
==== Edit Firewall Rule ====
* Protocol: Any

And that's it, unless you want to add a description. End result looks like this:

[[File:IPsec-any-rule.png]]

File:IPsec-any-rule.png

2019-07-20T03:21:56Z

Mauirixxx: Rule that allows all traffic across the VPN tunnel

Rule that allows all traffic across the VPN tunnel

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T03:20:59Z

Mauirixxx: /* Configuration */ all done

== About ==
How to setup an ipsec vpn between 2 instances of pfsense using both a static (work) and dynamic ip address (home office). However, a static IP is NOT a requirement.

== Software used ==
* pfSense: https://www.pfsense.org

== Requirements ==
* Dynamic '''OR''' static IP address
* A [https://www.namecheap.com/ domain name] or a [https://www.maketecheasier.com/best-dynamic-dns-providers/ free dynamic DNS provider].
* CPU with [https://en.wikipedia.org/wiki/AES_instruction_set AES-NI] (if your uplink is 20Mbps or faster)

== Configuration ==
I'm going to assume that if you're at this point, you already have a working pfSense configuration at both locations.

Both locations must NOT have the same internal LAN address - meaning both can't be running 192.168.1.x addresses, one can run 192.168.1.x while the other can run 192.168.2.x.

Final note - the VPN configuration on both firewalls will be exactly the same, save for parts that require IP addresses or hostnames.

Let's get started:
* Click on VPN -> IPsec, and on the bottom right, click on the green "'''+''' Add P1" button at the bottom of the screen.
=== Phase 1 ===
==== General Info ====
* Key exchange version: IKEv2
* Internet Protocol: IPv4 (IPv6/Dual stack will work if you're running IPv6 at both sites)
* Interface: WAN (or whatever you named the interface with the public IP address)
* Remote Gateway: this is where you need either your own domain, or a free Dynaimc DNS provider - or manually entering the IP addresses works, users with dynamic IP addresses the "work" location will have to update your IP address manually every time it changes.
** Remote Gateway (home): work.piracyforjesus.xyz
** Remote Gateway (work): home.piracyforjesus.xyz
* Description: put whatever you like or leave blank
==== Phase 1 Proposal (Authentication) ====
* Authentication Method: Mutual PSK
* My Identifier: Distinguished name:
** Home: home.piracyforjesus.xyz
** Work: work.piracyforjesus.xyz
* Peer identifier: Distinguished name
** Home: work.piracyforjesus.xyz
** Work: home.piracyforjesus.xyz
* Pre-Shared Key: On one firewall, click generate key, then copy & paste that key to the other firewall

==== Phase 1 Proposal (Encryption Algorithm) ====
* Encryption Algorithm:
** Algorithm: AES128-GCM
** Key Length: 128 bits
** Hash: SHA256
** DH Group: 14 (2048)
* Lifetime (Seconds): 28800
==== Advanced Options ====
Leave everything defaulted in this section, and click Save. When finished, it should look like this:
[[File:Phase1-complete.png]]

=== Phase 2 ===
From the above screen, click on "Show Phase 2 Entries (0)" and expand out the menu, then click on the green "'''+''' Add P2" button that appears.
==== General Information ====
* Mode: Tunnel IPv4
* Local Network: LAN subnet
* NAT/BINAT translation: None
* Remote Network: Network
** Address (Work): 192.168.10.0/24
** Address (Home): 192.168.1.0/24
* Description:
** Home: Work LAN
** Work: Home LAN
==== Phase 2 Proposal (SA/Key Exchange) ====
* Protocol: ESP
* Encryption Algorithms: AES128-GCM @ 128 bits
* Hash Algorithms: AES-XCBC (or SHA256 if your CPU doesn't have AES-NI)
* PFS key group: 14 (2048)
* Lifetime: 3600
==== Advanced Configuration ====
* Automatically ping host: set this IP address to a server you run 24/7, this will keep the VPN up 24/7

After you hit save, this is what your Phase 2 will look like:

[[File:Phase2-complete.png]]
== Firewall Rules ==
After you hit "Apply Changes" on both firewalls, your IPsec VPN should connect right away. You may find that you can't ping anything across the VPN though - you'll need to click on Firewall -> Rules -> Add to create a hole in the firewall to allow traffic to pass.
=== Insecure allow all traffic rule ===
This rule will allow ALL traffic to traverse the firewalls (remember you have to make the same rule for both sides). This is NOT a secure setting! If your home network gets compromised, your home network can be a jumping off point for bots/hackers/viruses to invade the network on the other side of the VPN.

''' You have been warned.'''
==== Edit Firewall Rule ====
* Protocol: Any

And that's it, unless you want to add a description. End result looks like this:

[[File:IPsec-any-rule.png]]

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T03:11:11Z

Mauirixxx: /* Advanced Configuration */ formatting

== About ==
How to setup an ipsec vpn between 2 instances of pfsense using both a static (work) and dynamic ip address (home office). However, a static IP is NOT a requirement.

== Software used ==
* pfSense: https://www.pfsense.org

== Requirements ==
* Dynamic '''OR''' static IP address
* A [https://www.namecheap.com/ domain name] or a [https://www.maketecheasier.com/best-dynamic-dns-providers/ free dynamic DNS provider].
* CPU with [https://en.wikipedia.org/wiki/AES_instruction_set AES-NI] (if your uplink is 20Mbps or faster)

== Configuration ==
I'm going to assume that if you're at this point, you already have a working pfSense configuration at both locations.

Both locations must NOT have the same internal LAN address - meaning both can't be running 192.168.1.x addresses, one can run 192.168.1.x while the other can run 192.168.2.x.

Final note - the VPN configuration on both firewalls will be exactly the same, save for parts that require IP addresses or hostnames.

Let's get started:
* Click on VPN -> IPsec, and on the bottom right, click on the green "'''+''' Add P1" button at the bottom of the screen.
=== Phase 1 ===
==== General Info ====
* Key exchange version: IKEv2
* Internet Protocol: IPv4 (IPv6/Dual stack will work if you're running IPv6 at both sites)
* Interface: WAN (or whatever you named the interface with the public IP address)
* Remote Gateway: this is where you need either your own domain, or a free Dynaimc DNS provider - or manually entering the IP addresses works, users with dynamic IP addresses the "work" location will have to update your IP address manually every time it changes.
** Remote Gateway (home): work.piracyforjesus.xyz
** Remote Gateway (work): home.piracyforjesus.xyz
* Description: put whatever you like or leave blank
==== Phase 1 Proposal (Authentication) ====
* Authentication Method: Mutual PSK
* My Identifier: Distinguished name:
** Home: home.piracyforjesus.xyz
** Work: work.piracyforjesus.xyz
* Peer identifier: Distinguished name
** Home: work.piracyforjesus.xyz
** Work: home.piracyforjesus.xyz
* Pre-Shared Key: On one firewall, click generate key, then copy & paste that key to the other firewall

==== Phase 1 Proposal (Encryption Algorithm) ====
* Encryption Algorithm:
** Algorithm: AES128-GCM
** Key Length: 128 bits
** Hash: SHA256
** DH Group: 14 (2048)
* Lifetime (Seconds): 28800
==== Advanced Options ====
Leave everything defaulted in this section, and click Save. When finished, it should look like this:
[[File:Phase1-complete.png]]

=== Phase 2 ===
From the above screen, click on "Show Phase 2 Entries (0)" and expand out the menu, then click on the green "'''+''' Add P2" button that appears.
==== General Information ====
* Mode: Tunnel IPv4
* Local Network: LAN subnet
* NAT/BINAT translation: None
* Remote Network: Network
** Address (Work): 192.168.10.0/24
** Address (Home): 192.168.1.0/24
* Description:
** Home: Work LAN
** Work: Home LAN
==== Phase 2 Proposal (SA/Key Exchange) ====
* Protocol: ESP
* Encryption Algorithms: AES128-GCM @ 128 bits
* Hash Algorithms: AES-XCBC (or SHA256 if your CPU doesn't have AES-NI)
* PFS key group: 14 (2048)
* Lifetime: 3600
==== Advanced Configuration ====
* Automatically ping host: set this IP address to a server you run 24/7, this will keep the VPN up 24/7

After you hit save, this is what your Phase 2 will look like:

[[File:Phase2-complete.png]]

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T02:52:51Z

Mauirixxx: /* Phase 1 Proposal (Authentication) */ strange that neither one like the peer identifier of their ip address

== About ==
How to setup an ipsec vpn between 2 instances of pfsense using both a static (work) and dynamic ip address (home office). However, a static IP is NOT a requirement.

== Software used ==
* pfSense: https://www.pfsense.org

== Requirements ==
* Dynamic '''OR''' static IP address
* A [https://www.namecheap.com/ domain name] or a [https://www.maketecheasier.com/best-dynamic-dns-providers/ free dynamic DNS provider].
* CPU with [https://en.wikipedia.org/wiki/AES_instruction_set AES-NI] (if your uplink is 20Mbps or faster)

== Configuration ==
I'm going to assume that if you're at this point, you already have a working pfSense configuration at both locations.

Both locations must NOT have the same internal LAN address - meaning both can't be running 192.168.1.x addresses, one can run 192.168.1.x while the other can run 192.168.2.x.

Final note - the VPN configuration on both firewalls will be exactly the same, save for parts that require IP addresses or hostnames.

Let's get started:
* Click on VPN -> IPsec, and on the bottom right, click on the green "'''+''' Add P1" button at the bottom of the screen.
=== Phase 1 ===
==== General Info ====
* Key exchange version: IKEv2
* Internet Protocol: IPv4 (IPv6/Dual stack will work if you're running IPv6 at both sites)
* Interface: WAN (or whatever you named the interface with the public IP address)
* Remote Gateway: this is where you need either your own domain, or a free Dynaimc DNS provider - or manually entering the IP addresses works, users with dynamic IP addresses the "work" location will have to update your IP address manually every time it changes.
** Remote Gateway (home): work.piracyforjesus.xyz
** Remote Gateway (work): home.piracyforjesus.xyz
* Description: put whatever you like or leave blank
==== Phase 1 Proposal (Authentication) ====
* Authentication Method: Mutual PSK
* My Identifier: Distinguished name:
** Home: home.piracyforjesus.xyz
** Work: work.piracyforjesus.xyz
* Peer identifier: Distinguished name
** Home: work.piracyforjesus.xyz
** Work: home.piracyforjesus.xyz
* Pre-Shared Key: On one firewall, click generate key, then copy & paste that key to the other firewall

==== Phase 1 Proposal (Encryption Algorithm) ====
* Encryption Algorithm:
** Algorithm: AES128-GCM
** Key Length: 128 bits
** Hash: SHA256
** DH Group: 14 (2048)
* Lifetime (Seconds): 28800
==== Advanced Options ====
Leave everything defaulted in this section, and click Save. When finished, it should look like this:
[[File:Phase1-complete.png]]

=== Phase 2 ===
From the above screen, click on "Show Phase 2 Entries (0)" and expand out the menu, then click on the green "'''+''' Add P2" button that appears.
==== General Information ====
* Mode: Tunnel IPv4
* Local Network: LAN subnet
* NAT/BINAT translation: None
* Remote Network: Network
** Address (Work): 192.168.10.0/24
** Address (Home): 192.168.1.0/24
* Description:
** Home: Work LAN
** Work: Home LAN
==== Phase 2 Proposal (SA/Key Exchange) ====
* Protocol: ESP
* Encryption Algorithms: AES128-GCM @ 128 bits
* Hash Algorithms: AES-XCBC (or SHA256 if your CPU doesn't have AES-NI)
* PFS key group: 14 (2048)
* Lifetime: 3600
==== Advanced Configuration ====
* Automatically ping host: set this IP address to a server you run 24/7, this will keep the VPN up 24/7

After you hit save, this is what your Phase 2 will look like:
[[File:Phase2-complete.png]]

File:Phase2-complete.png

2019-07-20T02:51:18Z

Mauirixxx: Completed phase 2

Completed phase 2

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T02:13:23Z

Mauirixxx: /* Phase 2 */ done sort of

== About ==
How to setup an ipsec vpn between 2 instances of pfsense using both a static (work) and dynamic ip address (home office). However, a static IP is NOT a requirement.

== Software used ==
* pfSense: https://www.pfsense.org

== Requirements ==
* Dynamic '''OR''' static IP address
* A [https://www.namecheap.com/ domain name] or a [https://www.maketecheasier.com/best-dynamic-dns-providers/ free dynamic DNS provider].
* CPU with [https://en.wikipedia.org/wiki/AES_instruction_set AES-NI] (if your uplink is 20Mbps or faster)

== Configuration ==
I'm going to assume that if you're at this point, you already have a working pfSense configuration at both locations.

Both locations must NOT have the same internal LAN address - meaning both can't be running 192.168.1.x addresses, one can run 192.168.1.x while the other can run 192.168.2.x.

Final note - the VPN configuration on both firewalls will be exactly the same, save for parts that require IP addresses or hostnames.

Let's get started:
* Click on VPN -> IPsec, and on the bottom right, click on the green "'''+''' Add P1" button at the bottom of the screen.
=== Phase 1 ===
==== General Info ====
* Key exchange version: IKEv2
* Internet Protocol: IPv4 (IPv6/Dual stack will work if you're running IPv6 at both sites)
* Interface: WAN (or whatever you named the interface with the public IP address)
* Remote Gateway: this is where you need either your own domain, or a free Dynaimc DNS provider - or manually entering the IP addresses works, users with dynamic IP addresses the "work" location will have to update your IP address manually every time it changes.
** Remote Gateway (home): work.piracyforjesus.xyz
** Remote Gateway (work): home.piracyforjesus.xyz
* Description: put whatever you like or leave blank
==== Phase 1 Proposal (Authentication) ====
* Authentication Method: Mutual PSK
* My Identifier: Distinguished name:
** Home: home.piracyforjesus.xyz
** Work: work.piracyforjesus.xyz
* Peer identifier: Peer IP address
* Pre-Shared Key: On one firewall, click generate key, then copy & paste that key to the other firewall
==== Phase 1 Proposal (Encryption Algorithm) ====
* Encryption Algorithm:
** Algorithm: AES128-GCM
** Key Length: 128 bits
** Hash: SHA256
** DH Group: 14 (2048)
* Lifetime (Seconds): 28800
==== Advanced Options ====
Leave everything defaulted in this section, and click Save. When finished, it should look like this:
[[File:Phase1-complete.png]]

=== Phase 2 ===
From the above screen, click on "Show Phase 2 Entries (0)" and expand out the menu, then click on the green "'''+''' Add P2" button that appears.
==== General Information ====
* Mode: Tunnel IPv4
* Local Network: LAN subnet
* NAT/BINAT translation: None
* Remote Network: Network
** Address (Work): 192.168.10.0/24
** Address (Home): 192.168.1.0/24
* Description:
** Home: Work LAN
** Work: Home LAN
==== Phase 2 Proposal (SA/Key Exchange) ====
* Protocol: ESP
* Encryption Algorithms: AES128-GCM @ 128 bits
* Hash Algorithms: AES-XCBC (or SHA256 if your CPU doesn't have AES-NI)
* PFS key group: 14 (2048)
* Lifetime: 3600
==== Advanced Configuration ====
* Automatically ping host: set this IP address to a server you run 24/7, this will keep the VPN up 24/7

After you hit save, this is what your Phase 2 will look like:
[[File:Phase2-complete.png]]

File:Phase1-complete.png

2019-07-20T01:59:43Z

Mauirixxx: Mauirixxx uploaded a new version of File:Phase1-complete.png

finished setting up phase 1 of an IPsec VPN.

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T01:58:45Z

Mauirixxx: /* Configuration */ starting phase 2

File:Phase1-complete.png

2019-07-20T01:52:14Z

Mauirixxx: Mauirixxx uploaded a new version of File:Phase1-complete.png

finished setting up phase 1 of an IPsec VPN.

File:Phase1-complete.png

2019-07-20T01:49:05Z

Mauirixxx: finished setting up phase 1 of an IPsec VPN.

finished setting up phase 1 of an IPsec VPN.

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T01:48:09Z

Mauirixxx: /* Advanced Options */

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T01:47:54Z

Mauirixxx: finished phase 1

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T01:28:20Z

Mauirixxx: /* Configuration */ saving current progress

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T00:55:31Z

Mauirixxx: /* Requirements */ updated AES-NI

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T00:46:14Z

Mauirixxx: /* Configuration */ updated

User:Mauirixxx/pfSense IPSec VPN

2019-07-20T00:45:07Z

Mauirixxx: initial edit and save

User:Mauirixxx

2019-07-20T00:33:40Z

Mauirixxx: formatting

* [[User:Mauirixxx/Scratch|My work in progress page]]
* [[User:Mauirixxx/Bugs|Got bugs?]]
* [[User:Mauirixxx/FreeNAS as a DC|FreeNAS as a Domain Controller]]
* [[User:Mauirixxx/FreeNAS 9.3 and Server 2012 R2 Domain Controller|FreeNAS 9.3 and Server 2012 R2 Domain Controller]]
* [[User:Mauirixxx/pfSense IPSec VPN|pfSense IPSec VPN]]

User:Mauirixxx

2019-07-20T00:33:11Z

Mauirixxx: more work to do

Main Page

2017-12-19T11:00:13Z

Mauirixxx: /* Tested */ need to document the 9.10.x line still

__NOTOC__

== About ==
This post is a collaboration between [http://forums.freenas.org/index.php?members/bigphil.36777/ bigphil] and [http://forums.freenas.org/index.php?members/mauirixxx.33311/ mauirixxx] of the [http://forums.freenas.org/index.php?forums/user-authentication.19/ FreeNAS forum] pooling our knowledge together of making FreeNAS work with the various flavors of Active Directory, in order to use Windows based permissions on files hosted on the FreeNAS server.

== Tested ==
This how-to has been tested with the following software releases, with this how-to being written using FreeNAS 9.2.1.5 & 9.3:
* FreeNAS v9.1.1-RELEASE-x64 (a752d35)
* FreeNAS v9.2.1.4.1-RELEASE-x64 (fec915c)
* FreeNAS v9.2.1.5-RELEASE-x64 (80c1d35)
* FreeNAS v9.3-STABLE-201601181840
* FreeNAS v9.10.2-U6 (561f0d7a1) - (undocumented, currently used in production @ my job)
* FreeNAS-Corral-10.0.3 (4845fa74c)
* Microsoft Windows Server 2008
* Microsoft Windows Server 2008 R2
* Microsoft Windows Server 2012 R2

=== UnTested ===
* FreeNAS 11.x

== Assumptions ==
* This how-to assumes you already have a '''working''' Active Directory installation.
* [http://support.microsoft.com/gp/contactus81?Audience=Commercial&SegNo=5 Active Directory support] is beyond the scope of this document.
* We assume you have the required access to create user and computer objects in Active Directory, as well as access to create the necessary records required in DNS.
* We assume you are using a fresh install of FreeNAS.
* We assume you have a current backup of your Active Directory setup.

== DISCLAIMER ==
* We are NOT responsible for YOU breaking YOUR Active Directory installation - not that you will, but "stuff" happens.

== Getting started ==
* Start here - [[Active Directory Prep]]
* End here - [[FreeNAS 9.2.1.5 setup]] or [[FreeNAS 9.3.x setup]] or [[FreeNAS Corral 10.x setup]]
* Managing File/Folder/User permissions - [[Permissions Management]]
* Known bugs & solutions with FreeNAS 9.2.1.5 - [[Issues]]

== Support ==
* [https://forums.freenas.org/index.php?threads/how-to-properly-setup-freenas-to-use-active-directory-folder-file-user-permissions.20610/ Support thread]

FreeNAS Corral 10.x setup

2017-05-16T20:20:23Z

Mauirixxx: /* Prepping SMB (CIFS) File Sharing */ changed 7 to Vista as SMB2 rolled out with Vista, not 7

[[Category:FreeNAS-AD]]
[[Category:FreeNAS-Setup]]
== Before we start ==
* We used a virtualized setup in order to create this walkthrough, using generic domain & computer names where possible.
* We used the private IP address range of 192.168.15.x - obviously you'll want to replace our internal IP addresses with your own
** We used a single Active Directory domain controller, to keep things simple. We then configured the following network settings, which is reflected throughout this document:
*** Gateway: 192.168.15.1
*** DNS: 192.168.15.3
*** NTP: 192.168.15.3
*** DC (Domain Controller): 192.168.15.3
*** FreeNAS Corral: 192.168.15.4

* Where appropriate, we'll make a note of where additional server IP's can be entered, for redundancy
* Generic Password: HorseBattery@2017

== Getting started with FreeNAS ==
=== Initial connection ===
* When FreeNAS Corral 10.0 is first installed, the network adapter is set to DHCP - we will change this a few steps down. We will be configuring FreeNAS purely from the webUI, so make a note of the IP on the FreeNAS server console:
[[File:FreeNAS Corral 10.0 DHCP on first boot.png]]
* Use your favorite web browser to connect to that address - The FreeNAS webUI will prompt you for a password, for the default user '''root''' using the password you set during the installation routine.
* To change from a dynamic IP to a static IP, after you log in, on the left menu click on Network -> Interfaces -> "Interface name" (dhcp)
[[File:FreeNAS Corral 10.0 Change Interface DHCP Setting.png]]
* On the next screen, uncheck DHCP, and then:
** Click on Add address
**[[File:FreeNAS Corral 10.0 Add address.png]]
** Click the IPv4 radio button, and add '''192.168.15.4''' under Address, and '''255.255.255.0''' under Subnet mask / Prefix length and click '''Done''', then click '''Save''' at the bottom of the page, and then click '''Save''' again.
**[[File:FreeNAS Corral 10.0 Enter IPv4 address and subnet mask.png]]
** Then click on '''Settings''' under Interfaces, and change the following:
*** Hostname: freenas.mai-dev.net
*** HTTP Proxy: leave blank
*** '''DHCP Settings'''
**** Assign Gateway: uncheck
**** Assign DNS: uncheck
*** '''Gateway Settings'''
**** IPv4: 192.168.15.1
**** IPv6: leave blank unless you're actively using IPv6 in your environment
*** '''DNS Settings'''
**** IP Addresses -> Add DNS Address: '''192.168.15.3'''
**** Search Domains -> Add Search Domain: mai-dev.net
*** Click '''Save'''
=== Configuring Time Server ===
* On the left menu, click System -> Language & Region
** Change the timezone to the timezone you FreeNAS server resides in (I used Pacific/Honolulu for this demo)
* Then, again from the left menu, click System -> NTP -> NTP Servers [[File:corral-plus-symbol.png]] -> Add an NTP Server
** Address: 192.168.15.3
** Initial Burst: checked
** Preferred: checked - only if you're leaving the default NTP servers in place, otherwise leave unchecked
** [[File:FreeNAS Corral 10.0 NTP Servers.png|200px]] When everything is done it should look like this (click image to zoom)
** Click '''Save''', then click on '''Dashboard''' to verify proper System Time

=== Connecting to Active Directory (finally!) ===
* From the left menu, click on Accounts -> Directory Services
** NTP Servers: Select 192.168.15.3 from the drop down menu and then click '''Synchronize with NTP server''' (just to be safe).
*** Then click on '''Active Directory''' and fill in the required information:
**** Name: active directory testing (or whatever you want)
**** Domain Name (DNS/Realm-Name): MAI-DEV.NET
**** Domain Account Name: freenasadmin
**** Domain Account Password: HorseBattery@2017
**** Enabled: checked
**** Verify everything: [[File:FreeNAS Corral 10.0 Active Directory setup.png|200px]] (click image to zoom)
**** Click on '''Save'''
***** If it worked, there should be a green "dot" next to the '''Active Directory''' box: [[File:FreeNAS Corral 10.0 Active Directory green.png|130px]]
**** You should be able to see users in Active Directory at this point by clicking on Accounts -> Users: [[File:FreeNAS Corral 10.0 Active Directory users.png|150px]] (click image to zoom)

=== Creating a Storage Pool ===
* This is beyond the scope of this walkthrough, however:
* The [http://doc.freenas.org/index.php/Volumes official FreeNAS wiki] is an excellent resource on creating your storage pool.
* We also suggest giving [http://forums.freenas.org/index.php?threads/slideshow-explaining-vdev-zpool-zil-and-l2arc-for-noobs.7775/ cyberjocks excellent PowerPoint] presentation explaining what VDev zpool, ZIL and L2ARC is.
** After your pool is created, we suggest creating a dataset specifically for CIFS sharing.
** Again, the [http://doc.freenas.org/index.php/Volumes#Creating_ZFS_Datasets official FreeNAS wiki] is a good source of info on how to do this
=== Prepping SMB (CIFS) File Sharing ===
* From the left menu, click on Services -> Sharing -> SMB
** Enabled: checked
** NetBIOS Name: FreeNAS
** Workgroup: MAI-DEV (this should match your domain name, only without the .com .net etc etc...)
** Description: FreeNAS Plexmedia Server
** Server minimum protocol: SMB2 (unless you're using clients older than Windows Vista)
** Everything else, leave at the default settings
** Click '''Save'''

FreeNAS Corral 10.x setup

2017-04-18T00:57:27Z

Mauirixxx: /* Creating a Storage Pool */

[[Category:FreeNAS-AD]]
[[Category:FreeNAS-Setup]]
== Before we start ==
* We used a virtualized setup in order to create this walkthrough, using generic domain & computer names where possible.
* We used the private IP address range of 192.168.15.x - obviously you'll want to replace our internal IP addresses with your own
** We used a single Active Directory domain controller, to keep things simple. We then configured the following network settings, which is reflected throughout this document:
*** Gateway: 192.168.15.1
*** DNS: 192.168.15.3
*** NTP: 192.168.15.3
*** DC (Domain Controller): 192.168.15.3
*** FreeNAS Corral: 192.168.15.4

* Where appropriate, we'll make a note of where additional server IP's can be entered, for redundancy
* Generic Password: HorseBattery@2017

== Getting started with FreeNAS ==
=== Initial connection ===
* When FreeNAS Corral 10.0 is first installed, the network adapter is set to DHCP - we will change this a few steps down. We will be configuring FreeNAS purely from the webUI, so make a note of the IP on the FreeNAS server console:
[[File:FreeNAS Corral 10.0 DHCP on first boot.png]]
* Use your favorite web browser to connect to that address - The FreeNAS webUI will prompt you for a password, for the default user '''root''' using the password you set during the installation routine.
* To change from a dynamic IP to a static IP, after you log in, on the left menu click on Network -> Interfaces -> "Interface name" (dhcp)
[[File:FreeNAS Corral 10.0 Change Interface DHCP Setting.png]]
* On the next screen, uncheck DHCP, and then:
** Click on Add address
**[[File:FreeNAS Corral 10.0 Add address.png]]
** Click the IPv4 radio button, and add '''192.168.15.4''' under Address, and '''255.255.255.0''' under Subnet mask / Prefix length and click '''Done''', then click '''Save''' at the bottom of the page, and then click '''Save''' again.
**[[File:FreeNAS Corral 10.0 Enter IPv4 address and subnet mask.png]]
** Then click on '''Settings''' under Interfaces, and change the following:
*** Hostname: freenas.mai-dev.net
*** HTTP Proxy: leave blank
*** '''DHCP Settings'''
**** Assign Gateway: uncheck
**** Assign DNS: uncheck
*** '''Gateway Settings'''
**** IPv4: 192.168.15.1
**** IPv6: leave blank unless you're actively using IPv6 in your environment
*** '''DNS Settings'''
**** IP Addresses -> Add DNS Address: '''192.168.15.3'''
**** Search Domains -> Add Search Domain: mai-dev.net
*** Click '''Save'''
=== Configuring Time Server ===
* On the left menu, click System -> Language & Region
** Change the timezone to the timezone you FreeNAS server resides in (I used Pacific/Honolulu for this demo)
* Then, again from the left menu, click System -> NTP -> NTP Servers [[File:corral-plus-symbol.png]] -> Add an NTP Server
** Address: 192.168.15.3
** Initial Burst: checked
** Preferred: checked - only if you're leaving the default NTP servers in place, otherwise leave unchecked
** [[File:FreeNAS Corral 10.0 NTP Servers.png|200px]] When everything is done it should look like this (click image to zoom)
** Click '''Save''', then click on '''Dashboard''' to verify proper System Time

=== Connecting to Active Directory (finally!) ===
* From the left menu, click on Accounts -> Directory Services
** NTP Servers: Select 192.168.15.3 from the drop down menu and then click '''Synchronize with NTP server''' (just to be safe).
*** Then click on '''Active Directory''' and fill in the required information:
**** Name: active directory testing (or whatever you want)
**** Domain Name (DNS/Realm-Name): MAI-DEV.NET
**** Domain Account Name: freenasadmin
**** Domain Account Password: HorseBattery@2017
**** Enabled: checked
**** Verify everything: [[File:FreeNAS Corral 10.0 Active Directory setup.png|200px]] (click image to zoom)
**** Click on '''Save'''
***** If it worked, there should be a green "dot" next to the '''Active Directory''' box: [[File:FreeNAS Corral 10.0 Active Directory green.png|130px]]
**** You should be able to see users in Active Directory at this point by clicking on Accounts -> Users: [[File:FreeNAS Corral 10.0 Active Directory users.png|150px]] (click image to zoom)

=== Creating a Storage Pool ===
* This is beyond the scope of this walkthrough, however:
* The [http://doc.freenas.org/index.php/Volumes official FreeNAS wiki] is an excellent resource on creating your storage pool.
* We also suggest giving [http://forums.freenas.org/index.php?threads/slideshow-explaining-vdev-zpool-zil-and-l2arc-for-noobs.7775/ cyberjocks excellent PowerPoint] presentation explaining what VDev zpool, ZIL and L2ARC is.
** After your pool is created, we suggest creating a dataset specifically for CIFS sharing.
** Again, the [http://doc.freenas.org/index.php/Volumes#Creating_ZFS_Datasets official FreeNAS wiki] is a good source of info on how to do this
=== Prepping SMB (CIFS) File Sharing ===
* From the left menu, click on Services -> Sharing -> SMB
** Enabled: checked
** NetBIOS Name: FreeNAS
** Workgroup: MAI-DEV (this should match your domain name, only without the .com .net etc etc...)
** Description: FreeNAS Plexmedia Server
** Server minimum protocol: SMB2 (unless you're using clients older than Windows 7)
** Everything else, leave at the default settings
** Click '''Save'''

FreeNAS Corral 10.x setup

2017-04-18T00:26:28Z

Mauirixxx: /* Creating a Storage Pool */ added storage pool info, may need to be edited some more

FreeNAS Corral 10.x setup

2017-04-18T00:13:40Z

Mauirixxx:

FreeNAS Corral 10.x setup

2017-04-18T00:12:40Z

Mauirixxx:

{{Purge}}
[[Category:FreeNAS-AD]]
[[Category:FreeNAS-Setup]]
== Before we start ==
* We used a virtualized setup in order to create this walkthrough, using generic domain & computer names where possible.
* We used the private IP address range of 192.168.15.x - obviously you'll want to replace our internal IP addresses with your own
** We used a single Active Directory domain controller, to keep things simple. We then configured the following network settings, which is reflected throughout this document:
*** Gateway: 192.168.15.1
*** DNS: 192.168.15.3
*** NTP: 192.168.15.3
*** DC (Domain Controller): 192.168.15.3
*** FreeNAS Corral: 192.168.15.4

* Where appropriate, we'll make a note of where additional server IP's can be entered, for redundancy
* Generic Password: HorseBattery@2017

== Getting started with FreeNAS ==
=== Initial connection ===
* When FreeNAS Corral 10.0 is first installed, the network adapter is set to DHCP - we will change this a few steps down. We will be configuring FreeNAS purely from the webUI, so make a note of the IP on the FreeNAS server console:
[[File:FreeNAS Corral 10.0 DHCP on first boot.png]]
* Use your favorite web browser to connect to that address - The FreeNAS webUI will prompt you for a password, for the default user '''root''' using the password you set during the installation routine.
* To change from a dynamic IP to a static IP, after you log in, on the left menu click on Network -> Interfaces -> "Interface name" (dhcp)
[[File:FreeNAS Corral 10.0 Change Interface DHCP Setting.png]]
* On the next screen, uncheck DHCP, and then:
** Click on Add address
**[[File:FreeNAS Corral 10.0 Add address.png]]
** Click the IPv4 radio button, and add '''192.168.15.4''' under Address, and '''255.255.255.0''' under Subnet mask / Prefix length and click '''Done''', then click '''Save''' at the bottom of the page, and then click '''Save''' again.
**[[File:FreeNAS Corral 10.0 Enter IPv4 address and subnet mask.png]]
** Then click on '''Settings''' under Interfaces, and change the following:
*** Hostname: freenas.mai-dev.net
*** HTTP Proxy: leave blank
*** '''DHCP Settings'''
**** Assign Gateway: uncheck
**** Assign DNS: uncheck
*** '''Gateway Settings'''
**** IPv4: 192.168.15.1
**** IPv6: leave blank unless you're actively using IPv6 in your environment
*** '''DNS Settings'''
**** IP Addresses -> Add DNS Address: '''192.168.15.3'''
**** Search Domains -> Add Search Domain: mai-dev.net
*** Click '''Save'''
=== Configuring Time Server ===
* On the left menu, click System -> Language & Region
** Change the timezone to the timezone you FreeNAS server resides in (I used Pacific/Honolulu for this demo)
* Then, again from the left menu, click System -> NTP -> NTP Servers [[File:corral-plus-symbol.png]] -> Add an NTP Server
** Address: 192.168.15.3
** Initial Burst: checked
** Preferred: checked - only if you're leaving the default NTP servers in place, otherwise leave unchecked
** [[File:FreeNAS Corral 10.0 NTP Servers.png|200px]] When everything is done it should look like this (click image to zoom)
** Click '''Save''', then click on '''Dashboard''' to verify proper System Time

=== Connecting to Active Directory (finally!) ===
* From the left menu, click on Accounts -> Directory Services
** NTP Servers: Select 192.168.15.3 from the drop down menu and then click '''Synchronize with NTP server''' (just to be safe).
*** Then click on '''Active Directory''' and fill in the required information:
**** Name: active directory testing (or whatever you want)
**** Domain Name (DNS/Realm-Name): MAI-DEV.NET
**** Domain Account Name: freenasadmin
**** Domain Account Password: HorseBattery@2017
**** Enabled: checked
**** Verify everything: [[File:FreeNAS Corral 10.0 Active Directory setup.png|200px]] (click image to zoom)
**** Click on '''Save'''
***** If it worked, there should be a green "dot" next to the '''Active Directory''' box: [[File:FreeNAS Corral 10.0 Active Directory green.png|130px]]
**** You should be able to see users in Active Directory at this point by clicking on Accounts -> Users: [[File:FreeNAS Corral 10.0 Active Directory users.png|150px]] (click image to zoom)

=== Creating a Storage Pool ===
* This is beyond the scope of this walkthrough

File:FreeNAS Corral 10.0 Active Directory users.png

Active Directory Prep

2017-04-17T21:26:47Z

Mauirixxx: /* FreeNAS setup */ fixed link

[[Category:FreeNAS-AD]]
== Before we start ==
* There is little difference in the Active Directory setup between Window Server 2003 & R2, 2008 & R2, and 2012 & R2. Have not tested Server 2016 yet, but I assume it will be similar as well.
* We used a virtualized setup in order to create this walkthrough, using generic domain & computer names where possible.
* We used the private IP address range of 10.10.10.x - obviously you'll want to replace our internal IP addresses with your own
** We used a single Active Directory domain controller, to keep things simple. We then configured the following network settings, which is reflected throughout this document:
*** Gateway: 10.10.10.1
*** DNS: 10.10.10.3
*** NTP: 10.10.10.3
*** DC (Domain Controller): 10.10.10.3
*** FreeNAS: 10.10.10.4

== DNS Prep ==
* Create a DNS "A" record
[[File:DNS A record.png]]
== Adding a FreeNAS user ==
* Create a FreeNAS user specifically for joining the FreeNAS server to the domain, named '''freenasAdmin'''
[[File:User freenasAdmin creation.png]]
* Create a non-expiring password for user freenasAdmin
[[File:User freenasAdmin password.png]]
== Pre-creating FreeNAS computer object in AD ==
* Create a computer account in preparation for joining the FreeNAS server to the domain. The name should match the "A" record you created earlier.
** Before clicking OK to finalize the computer account creation, click "Change" and assign the previously created user "freenasAdmin" the ability to join the server to the domain
*** NOTE: Normal users in Active Directory CAN join computers to a domain, but there's a predefined limit of to how many times (it's 10) this can happen - this may not apply to Server 2008 and above, needs verification
[[File:Computer freenas account creation.png]]
* Afterwards, right click on the "freenas" computer object, and select Properties, then click on the Security tab, and give the freenasAdmin user "Full Control" and click OK.
** NOTE: If you don't see the security tab, you need to switch your view to "Advanced Features" - you can see where [[:File:View Advanced Features.png|HERE]].
[[File:Computer freenas give user freenasAdmin full control.png]]
* Verify the accuracy of your server's clock - since every computer joined in the domain will be using the DC as a time server as well, it needs to be accurate.
== NTP server prep ==
* From a CMD prompt, type '''w32tm /query /configuration''' - if NtpServer shows time.windows.com - you should really think about changing it.
** To change the time server to both use a more accurate clock, and redundant clocks, type the following:
*** '''w32tm /config /syncfromflags:manual /manualpeerlist:"0.us.pool.ntp.org,0x1 1.us.pool.ntp.org,0x1 2.us.pool.ntp.org,0x1" /update /reliable:yes'''
*** If you got any result '''other''' then "The command completed successfully", verify your command line. View an example successful result [[:File:W32tm command to add multiple time servers.png|HERE]].
*** Restart the Windows time service by issuing the following command '''net stop w32time && net start w32time'''. View an example successful restart [[:File:Restart Windows time service.png|HERE]].

== FreeNAS setup ==
* If everything went ok, move on to [[:Category:FreeNAS-Setup|FreeNAS setup]]

FreeNAS Corral 10.x setup

2017-04-17T21:25:36Z

Mauirixxx: added to new category

FreeNAS 9.2.1.5 setup

2017-04-17T21:25:21Z

Mauirixxx: added new category

[[Category:FreeNAS-AD]]
[[Category:FreeNAS-Setup]]
== Before we start ==
* We used a virtualized setup in order to create this walkthrough, using generic domain & computer names where possible.
* We used the private IP address range of 10.10.10.x - obviously you'll want to replace our internal IP addresses with your own
** We used a single Active Directory domain controller, to keep things simple. We then configured the following network settings, which is reflected throughout this document:
*** Gateway: 10.10.10.1
*** DNS: 10.10.10.3
*** NTP: 10.10.10.3
*** DC (Domain Controller): 10.10.10.3
*** FreeNAS: 10.10.10.4

* Where appropriate, we'll make a note of where additional server IP's can be entered, for redundancy

== Getting started with FreeNAS ==
=== Initial connection ===
* When FreeNAS 9.2.1.5 is first installed, the network adapter is set to DHCP - we will change this a few steps down. We will be configuring FreeNAS purely from the webUI, so make a note of the IP on the FreeNAS server console:
[[File:FreeNAS DHCP on first boot.png]]
* Use your favorite web browser to connect to that address - the first visit to the FreeNAS webUI will prompt you for a password, for the default user '''root'''
[[File:FreeNAS first visit password prompt.png]]
=== Configuring networking ===
* Click on Network -> Global Configuration
** Hostname: freenas (this needs to match the DNS "A" record & computer account name you created during the [[Active Directory Prep|Active Directory prep]])
** Domain: example-domain.net
** IPv4 Default Gateway: 10.10.10.1
** Nameserver 1: 10.10.10.3
** Click "Save"
[[File:FreeNAS network settings - global configuration.png]]
* Click on Network -> Interfaces -> Add Interface
** NIC: select the NIC being used by FreeNAS (single NIC systems only have 1 item in the dropdown list)
** Interface Name: em0 (We named it the same as what FreeNAS names it, for consistency - you can name it whatever you like)
** DHCP: unchecked
** IPv4 Address: 10.10.10.4 (this needs to match the DNS "A" record you created during the Active Directory prep)
** IPv4 Netmask: /24
** Click "Save"
*** The new IP address takes effect immediately - repoint your browser to the new address to continue
[[File:FreeNAS network settings - add interface.png]]
* Click on Network -> Network Summary to verify previous settings
[[File:FreeNAS network settings - network summary.png]]

=== Configuring Time Server ===
* Click on System -> NTP Servers -> View NTP Servers
** Remove all 3 default NTP servers
** Click Add NTP Server
*** Address: 10.10.10.3
*** Prefer: checked (only if you have other time servers configured)
*** Leave everything else at its default setting
[[File:Add NTP server.png]]
* Now that the time server is set, you need to set your time zone
* Click on Settings -> General
** Timezone: (obviously select YOUR time zone)
** Directory Service: Active Directory (since we plan on using Active Directory)
** Click "Save"
[[File:System Settings Timezone.png]]

=== Creating a Storage Pool ===
* Your storage pool '''has''' to be created before you configure FreeNAS to use Active Directory, however that is beyond the scope of this how-to.
* The [http://doc.freenas.org/index.php/Volumes official FreeNAS wiki] is an excellent resource on creating your storage pool.
* We also suggest giving [http://forums.freenas.org/index.php?threads/slideshow-explaining-vdev-zpool-zil-and-l2arc-for-noobs.7775/ cyberjocks excellent PowerPoint] presentation explaining what VDev zpool, ZIL and L2ARC is.
** After your pool is created, we suggest creating a dataset specifically for CIFS sharing.
** Again, the [http://doc.freenas.org/index.php/Volumes#Creating_ZFS_Datasets official FreeNAS wiki] is a good source of info on how to do this
*** When creating the dataset, you have to take into consideration '''how''' this particular dataset will be used.
*** In this how-to, we are assuming the storage will be used to store already compressed files, and the following screenshot reflects that.
**** Dataset Name: downloads
**** Compression level: Off (everything's already compressed already)
**** Share type: Windows
**** Enable atime: Off (unless your backup solution scans this share, then turn it on)
**** ZFS Deduplication: Off
[[File:Create a dataset for CIFS sharing.png]]

=== Setting up Active Directory & CIFS ===
* Click on Services -> Directory Services -> Active Directory
** Domain name: example-domain.net
** NetBIOS Name: FREENAS
** Workgroup Name: EXAMPLE-DOMAIN
** Domain Account Name: freenasadmin
** Domain Account Password: StrongPassword1234
** Confirm Domain Account Password: StrongPassword1234
[[File:FreeNAS Active Directory settings.png]]
* Click on Services -> CIFS
** NetBIOS name: freenas
** Workgroup: EXAMPLE-DOMAIN
** Description: (optional to fill in)
** DOS charset: CP437
** UNIX charset: UTF-8
** Log Level: Minimum
** Use syslog: unchecked
** Local Master: unchecked
** Time Server for Domain: unchecked
** Guest Account: nobody
** File Mask: (leave this field blank)
** Directory Mask: (leave this field blank)
** EA Support: checked
** Support DOS File Attributes: checked
** Allow Empty Password: unchecked
** Auxiliary Parameters: (leave this field blank)
** Enable home directories: unchecked
** Enable home directories browsing: unchecked
** Home directories: (leave this field blank)
** Homes auxiliary parameters: (leave this field blank)
** Unix Extensions: checked
** Zeroconf share discovery: checked
** Hostnames lookups: checked
** Server minimum protocol: ---------
** Server maximum Protocol: SMB3
** Allow execute always: checked
** Click "OK"
[[File:CIFS Settings top.png]]
[[File:CIFS Settings bottom.png]]
* Click Services -> Control Services
** Turn on Directory Services
*** This will also automatically turn on the CIFS services. Turning on Directory Services can take up to a minute to start, be patient.

=== Creating your share using Windows permissions ===
* Click on Sharing -> Windows (CIFS) Shares -> Add Windows (CIFS) Share
** Name: Downloads (this is the name you'll see when you connect via Windows Explorer)
** Comment: (optional)
** Path: (browse to the path of the dataset created previously)
** Leave everything else at its default setting
** Click "OK"
[[File:Add Windows share.png]]

=== Dataset File/Folder Permissions ===
* Now we need to change the default owner & group on the dataset created
* Click on Store -> Volumes
** Expand your volumes until you find the dataset created for file sharing
** Click Change Permissions
*** Owner (user): EXAMPLE-DOMAIN\administrator
*** Owner (group): EXAMPLE-DOMAIN\domain users
*** Mode: (unchangeable)
*** Type of ACL: Windows / Mac
*** Set permission recursively: unchecked (unless you have files owned by a FreeNAS user stored in this dataset already)
*** Click "Change"
[[File:Dataset for CIFS change permission.png]]

== Verification ==
* From a Windows client, open Windows Explorer, and type in '''\\freenas''' - if everything is set properly, you should see the CIFS share you created earlier.
[[File:Windows Explorer - freenas share Downloads.png]]
* Enter into the shared directory, and as a simple test - create a folder. If you're allowed, then it worked!
[[File:Windows Explorer - freenas share test.png]]
* If you go into the FreeNAS shell, you can further verify permissions are using Active Directory style permissions
[[File:FreeNAS with Active Directory permissions.png]]

Category:FreeNAS-Setup

2017-04-17T21:25:03Z

Mauirixxx: killed red link

Links to the various versions of FreeNAS I have set up and bothered writing notes and taking screenshots

FreeNAS 9.3.x setup

2017-04-17T21:24:17Z

Mauirixxx: made new category

[[Category:FreeNAS-AD]]
[[Category:FreeNAS-Setup]]
== Before we start ==
* We used a virtualized setup in order to create this walkthrough, using generic domain & computer names where possible.
* We used the private IP address range of 10.1.1.x - obviously you'll want to replace our internal IP addresses with your own
** We used a single Active Directory domain controller, to keep things simple. We then configured the following network settings, which is reflected throughout this document:
*** Gateway: 10.1.1.1
*** DNS: 10.1.1.2
*** NTP: 10.1.1.2
*** DC (Domain Controller): 10.1.1.2
*** FreeNAS: 10.1.1.3

* Where appropriate, we'll make a note of where additional server IP's can be entered, for redundancy

== Getting started with FreeNAS ==
=== Initial connection ===
* When FreeNAS 9.3 is first installed, the network adapter is set to DHCP - we will change this a few steps down. We will be configuring FreeNAS purely from the webUI, so make a note of the IP on the FreeNAS server console:
[[File:FreeNAS 9.3 DHCP on first boot.png]]
* Use your favorite web browser to connect to that address - the first visit to the FreeNAS webUI will prompt you for a password, for the default user '''root'''
[[File:FreeNAS 9.3 first visit password prompt.png]]

=== Configuring networking ===
* Click on Network -> Global Configuration
** Hostname: freenas (this needs to match the DNS "A" record & computer account name you created during the [[Active Directory Prep|Active Directory prep]])
** Domain: mauiri.xxx
** IPv4 Default Gateway: 10.1.1.1
** Nameserver 1: 10.1.1.2
** Click "Save"
[[File:FreeNAS 9.3 network settings - global configuration.png]]
* Click on Network -> Interfaces -> Add Interface
** NIC: select the NIC being used by FreeNAS (single NIC systems only have 1 item in the dropdown list)
** Interface Name: em0 (We named it the same as what FreeNAS names it, for consistency - you can name it whatever you like)
** DHCP: unchecked
** IPv4 Address: 10.1.1.3 (this needs to match the DNS "A" record you created during the Active Directory prep)
** IPv4 Netmask: /24
** Click "Save"
*** The new IP address takes effect immediately - repoint your browser to the new address to continue
[[File:FreeNAS 9.3 network settings - add interface.png]]
* Click on Network -> Network Summary to verify previous settings
[[File:FreeNAS 9.3 network settings - network summary.png]]

=== Configuring Time Server ===
* Click on System -> General -> NTP Servers
** Remove all 3 default NTP servers
** Click Add NTP Server
*** Address: 10.1.1.2
*** Prefer: checked (only if you have other time servers configured)
*** Leave everything else at its default setting
[[File:FreeNAS 9.3 Add NTP server.png]]
* Now that the time server is set, you need to set your time zone
* Click on System -> General -> Timezone
** Timezone: (obviously select YOUR time zone)
** Click "Save"
[[File:FreeNAS 9.3 System Settings Timezone.png]]

=== Creating a Storage Pool ===
* Your storage pool '''has''' to be created before you configure FreeNAS to use Active Directory, however that is beyond the scope of this how-to.
* The [http://doc.freenas.org/index.php/Volumes official FreeNAS wiki] is an excellent resource on creating your storage pool.
* We also suggest giving [http://forums.freenas.org/index.php?threads/slideshow-explaining-vdev-zpool-zil-and-l2arc-for-noobs.7775/ cyberjocks excellent PowerPoint] presentation explaining what VDev zpool, ZIL and L2ARC is.
** After your pool is created, we suggest creating a dataset specifically for CIFS sharing.
** Again, the [http://doc.freenas.org/index.php/Volumes#Creating_ZFS_Datasets official FreeNAS wiki] is a good source of info on how to do this
*** When creating the dataset, you have to take into consideration '''how''' this particular dataset will be used.
**** Dataset Name: jobdata
**** Compression level: Inherit (lz4)
**** Share type: Windows
**** Case Sensitivity: Insensitive
**** Enable atime: Inherit (on) (you can turn this off for a small performance boost, but doing so will potentially break some backup programs)
**** ZFS Deduplication: Inherit (off)
[[File:FreeNAS 9.3 Create a dataset for CIFS sharing.png]]

=== Setting up Active Directory & CIFS ===
* Click on Directory Services -> Active Directory
** Domain name: mauiri.xxx
** Domain Account Name: freenasadmin
** Domain Account Password: HorseBattery@2016 (don't actually use this, please)
** Confirm Domain Account Password: HorseBattery@2016
** Click Save, this may take awhile. After it's complete, move on to setting up CIFS
[[File:FreeNAS 9.3 Active Directory setup.png]]
* Click on Services -> CIFS
* Leave everything at their default settings save for the following 2 items:
** Workgroup: MAUIRI

** Server Maximum Protocol: SMB3_00
* Click Services -> Control Services
** Turn on the CIFS service if it hasn't already started

=== Creating your share using Windows permissions ===
* Click on Sharing -> Windows (CIFS) Shares -> Add Windows (CIFS) Share
** Path: (browse to the path of the dataset created previously)
** Use as home share: Unchecked
** Name: JobData (this is the name you'll see when you connect via Windows Explorer)
** Apply Default Permissions: Checked
** Allow Gues Access: Unchecked
** Click "OK"
[[File:FreeNAS 9.3 Add Windows share.png]]

=== Dataset File/Folder Permissions ===
* Now we need to change the default owner & group on the dataset created
* Click on Storage -> Volumes
** Expand your volumes until you find the dataset created for file sharing
** Click Change Permissions
*** Apply Owner (user): Checked
*** Owner (user): MAUIRI\administrator
*** Apply Owner (group): Checked
*** Owner (group): MAUIRI\domain users
*** Apply Mode: Checked
*** Mode: (unchangeable)
*** Permission Type: Windows
*** Set permission recursively: unchecked (unless you have files owned by a FreeNAS user stored in this dataset already)
*** Click "Change"
[[File:FreeNAS 9.3 Dataset for CIFS change permission.png]]

== Verification ==
This was just copied and pasted from the FreeNAS 9.2.x walkthrough - while the paths may be different, the concept never changed.
* From a Windows client, open Windows Explorer, and type in '''\\freenas''' - if everything is set properly, you should see the CIFS share you created earlier.
[[File:Windows Explorer - freenas share Downloads.png]]
* Enter into the shared directory, and as a simple test - create a folder. If you're allowed, then it worked!
[[File:Windows Explorer - freenas share test.png]]
* If you go into the FreeNAS shell, you can further verify permissions are using Active Directory style permissions
[[File:FreeNAS with Active Directory permissions.png]]