1 NAS, 2 VLANs, and other questions

[DaveS]

I've been doing a lot of research and reading through the forums, but I've run into questions that appear to fall outside of the usual "which NAS should I buy" type. I've been looking at prosumer level 4/5 bay devices, like the Synology DS412+, Thecus N5550, and QNAP 469L.

My tentative home/home office network plan calls for 2 VLANs: One VLAN for my home network containing shared files, music and videos for streaming, backups for the family pcs, and assorted other stuff you'd typically find on a home network. The second VLAN is for all my business related stuff. Mostly file storage for things like VMware VMs, ISOs, computer backups, and etc., but I'd also use it for scc (Hg or Git) and an ftp server for clients. If you can decipher the chicken scratches, here's a rough sketch of what I'm thinking:

My network gear consists of a Routerboard 2011L as my gateway and a pair of Routerboard 951G as WAPs and multi-point wired drops. I'm expecting the VLANs to be static (tied to specific ports) rather than dynamic.

I've noticed it is possible to connect two different networks to NAS devices that have two network ports. I've also seen that on at least some devices (don't remember which one atm) you can restrict services to only one network port, effectively requiring users to be on the correct network in order to use it.

Q1: Is it possible to--for example--replace the 'File/Media Server' and 'FTP Server' blocks (under 'Router 3') with a single NAS device? Note the Media server is part of the home network and the FTP server is part of the work network. To be fair, I'm pretty green when it comes to network designs beyond a single subnet for home use, and what I'm proposing may not be a good idea.

Q2: Is it possible to create multiple volumes on the device and allow each one to be accessible only through a specific network port? I'd like to eliminate the possibility of having my daughters (or wife) accidentally mess up important business data.

Q3: I find the Drobo BeyondRAID (and to a lesser extent the Synology Hybrid RAID) feature very compelling. Does QNAP or Thecus have an equivalent feature?

Thanks,
Dave

 

[stevech]

Wouldn't VLANs be less costly than a dual-NIC NAS?
Unless cost isn't important.

I'd go to a one-router architecture - use switches in the other rooms. Or a WiFi router re-purposed to functionally be an AP with built in switch (WAN port unused).
So much easier without double-NATing.

 

[thiggins]

Using VLANs to separate home and business networks is a good use of the technology.

Using the multiple ports connected to the same subnet, but different VLANs won't work. And splitting services by VLAN on the same port probably isn't supported.

Why not just use password protected volumes (or even just folders) to protect data?

QNAP has volume expansion and RAID migration. Not as automatic as Drobo and Synology. Closest for that is Windows Server's Storage Spaces.

 

[DaveS]

Wouldn't VLANs be less costly than a dual-NIC NAS?
Unless cost isn't important.

I don't much like throwing money away so cost is always a factor, though not necessarily the most important factor. Can you expand on your suggestion to use VLANs instead of a dual-NIC NAS?

(Like I said, I'm a network noob. I hadn't heard of VLANs until I bought my routerboards and what I know of them I learned from Wikipedia.)

I'd go to a one-router architecture - use switches in the other rooms. Or a WiFi router re-purposed to functionally be an AP with built in switch (WAN port unused).

The two 951Gs (Router 2 and router 3 in the diagram) have router software built into them, but I'm essentially using them purely as switches and WAPs. (No double NATing.) They are fairly inexpensive at $80/ea, and my previous wireless router is over 10 years old so it needed replacing.

Why not just use password protected volumes (or even just folders) to protect data?

I'm saving that option as a last resort if I can't figure out something better. Eventually I'll be tying my work network into an existing network via permanent VPN. I'd much rather have layer 2 or layer 3 separation between my home and work networks.

(Stupid question of the day: When using password protected volumes or folders, does the user have to enter the password every time they access the folder? I know there are ways to integrate a NAS into a network with an active directory server, but the wife and kids are running Windows 7 Home on their laptops, which iirc can't join a domain. And I don't have an AD server anyway...)

Using the multiple ports connected to the same subnet, but different VLANs won't work. And splitting services by VLAN on the same port probably isn't supported.

<Thinking out loud>
Hmm... I might be able to create separate subnets instead of using VLANs, though I'd have to experiment with the routerboard settings to find out. If I can it sounds like the dual-NIC NASs do support that. However, it also sounds like connecting a single NAS to different subnets makes all the services available on both subnets, unless one chooses to restrict a service to only one of the network ports. Furthermore, it doesn't sound like there's a way to assign storage volume A to subnet 1 and storage volume B to subnet 2. Is that correct?

If my assumptions are accurate so far, it sounds like I'd need separate NASs for each network, or maybe figure out some way to run virtualized NAS servers. Sounds costly.

Closest for that is Windows Server's Storage Spaces.

I might fire up a VM and play around with Windows Server Essentials, but I'm reluctant to get roped into MS's server ecosystem. It seems to have a steeper learning curve and I can't find any information about app availability.

 

[coxhaus]

I think the easiest solution is to run server software. You can create shares for business and shares for home. This is what server software is built to do.

The other option is to create multiple separate networks using vlans or not and have a separate NAS for the business and one for the home network.

PS.
The file/media and FTP servers can be run off of one server along with the business and home shares. Again server is built to do this.