VPNSmith
self-host-vpnINFO

WireGuard on TrueNAS: Three Places to Put It, and Only One Survives an Update

TrueNAS gives you an app, a jail or a virtual machine, and the difference is not convenience. It decides what happens to your tunnel the next time the system updates, and whether the NAS itself is reachable when the tunnel is the only way in.

By Eric Gerard · Founder · VPNSmith - Self-host VPN & GDPR VPS specialist4 min readPhoto via Pexels

Affiliate disclosure - This post contains Contabo affiliate links. If you grab a VPS through them, we earn a commission at no extra cost to you.

Searching this gives you three tutorials that each pick a different place to install it, and none of them says why. The choice matters, and not for the reason people assume.

It is not about performance. It is about what survives the next system update, and about what is still reachable when something breaks.

The host is not yours to write to

The tempting route is SSH into TrueNAS, install the package, edit /etc/wireguard/wg0.conf, done. It works, and it lasts until the next update.

TrueNAS treats its boot environment as disposable: an update replaces it. Files you placed outside your storage pool are not part of what gets carried across. The tunnel then vanishes with no error, at the exact moment you are least likely to be watching, and the symptom is a NAS that simply stopped answering on its VPN address.

This is the single most common way people lose a WireGuard setup on TrueNAS, and it is entirely avoidable by never putting configuration on the host in the first place.

A patch panel in a dim rack, two rows of numbered ports above a bundle of green, yellow, red and orange network cables curving down out of the frame
A patch panel in a dim rack, two rows of numbered ports above a bundle of green, yellow, red and orange network cables curving down out of the frame

The three real options

An application from the catalogue. The path of least resistance on TrueNAS SCALE. Configuration lives in a dataset, so it persists, and updates are handled by the app framework rather than by you.

The cost is that you inherit the app's assumptions about networking. Getting a container to hand out routes to your LAN usually means host networking and a couple of settings that the interface does not explain, and troubleshooting happens through a layer you did not write.

A virtual machine. A minimal Debian guest with 512 MB of RAM, WireGuard installed the ordinary way, and full control of routing and firewall rules. Everything you already know applies, and nothing is hidden.

The costs are honest: the VM has to be running for the tunnel to exist, it is one more system to patch, and it consumes a slice of memory permanently. In exchange, when something breaks you are debugging plain Linux instead of an abstraction.

A jail, on TrueNAS CORE. Lighter than a VM and it worked well for years. It is also the option with the shortest remaining life, because CORE is being wound down in favour of SCALE. Choosing it today means planning the migration at the same time.

The question that decides it, and it is not technical

What is the tunnel for?

If it exists so that you can reach your whole home network from outside, the router is the better host, not the NAS. Routing stays in one place, and the tunnel survives the NAS being powered off or mid-update. A NAS that must be awake for your VPN to work is a single point of failure you chose by accident.

If it exists so that you can reach the NAS itself, including its web interface when nothing else on the network is responding, then it belongs on the NAS. That is a real use case and it is the one that justifies this whole setup.

If both, run it on the router and give the NAS a static address inside the tunnel subnet. You get one routing point and no dependency on the NAS being up.

Three things to get right whichever you pick

Persist the keys in a dataset, never on the boot pool. A key you cannot find after an update is the same as no key.

Enable IP forwarding inside whatever runs the tunnel, and remember that sysctl -w alone does not survive a reboot. The full set of rules for a forwarding endpoint is in WireGuard PostUp and PostDown iptables rules.

List your LAN subnet in AllowedIPs on the remote peer. This is where most home setups fail: the tunnel comes up, the NAS answers, and nothing else on the network does, because the peer was never told those addresses are reachable through the tunnel. The double duty this field performs is covered in our AllowedIPs guide.

If the NAS is behind CGNAT

A tunnel terminating at home needs an address the outside can reach, and a growing number of connections do not have one. The fix is a small VPS acting as the meeting point, with both the NAS and your laptop connecting outward to it.

That layout is described in WireGuard behind CGNAT, and what the cheap tiers actually deliver is in our cheapest VPS for WireGuard comparison. For a Proxmox host rather than a NAS, the placement question changes again: WireGuard on Proxmox.

★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed

Self-host your VPN on your own VPS → ContaboFull root access · public IPv4 · pick your region→

Frequently asked questions

Can TrueNAS run WireGuard natively?
TrueNAS SCALE runs it as an application from the catalogue or in a virtual machine; TrueNAS CORE used jails, which are being retired. There is no supported way to install packages directly into the host operating system on either edition, and doing it anyway is what gets wiped by the next update.
Why did my WireGuard config disappear after a TrueNAS update?
Because it was written to the host filesystem rather than to a dataset. TrueNAS treats the boot environment as disposable and replaces it on update. Anything outside your storage pool is not persisted, and that includes configuration files you edited by hand over SSH.
Should WireGuard run on the NAS or on the router?
On the router if the tunnel exists to reach your whole network, because it keeps routing in one place and survives the NAS being off. On the NAS if the tunnel exists to reach the NAS itself, and especially if you want its web interface reachable when nothing else is.
Does running WireGuard in a TrueNAS VM cost much?
A minimal Linux guest handling a home tunnel needs about 512 MB of RAM and almost no CPU while idle. The real cost is that the VM must be running for the tunnel to exist, so a NAS that suspends its VMs will drop the tunnel with them.
Related articles

Read next