Dual NIC for File Server

[traderyoda]

I operate a home business. In my media room I built a large workstation that serves many functions: kids use it as a game box, it serves up my music and media around the house via Squeezebox and Plex, monitors security systems and cams, and it provides file backups for my business. The machine has a Asus Maximus Hero VIII MB and handles all of the functions without breathing hard.

I now need to separate my business network completely from my home network. I built a QOTOM router with 4 NICs running pfSense which is working great. The router is set up for WAN-to-Dual-LAN. My home stuff is sitting on one subnet and my business on another with the two subnets isolated. There are three workstations on my business subnet and a dedicated Ubiquiti WAP. I have two smart switches: a Cisco and Ubiquiti Edgeswitch. The new router was just installed.

My media server has a very handy 4-drive hotswap bay. Two large drives are dedicated to home stuff and the other two to business. Before I installed the new router the two business drives were backing up the business workstations using a rather crude SyncToy setup. With the Dual-LAN setup I need another solution.

I could remove my business drives and install them in a dedicated business server or NAS sitting on the business subnet. But I'm wondering if I could simply install a second NIC in this machine and route my business subnet to it to access the two business drives. I'd prefer this because the machine has been rock solid and I'd like to avoid more boxes with learning curves and inevitable installation issues. Time is an issue... I just spent over a week getting pfSense and the switches working with Dual-LAN, VLANs, VPN, etc. - not an easy chore!

If this could work I'm not sure how I would handle this - how do I associate those two business drive bays to traffic from this second NIC? Assuming I can assign these drives can anyone recommend a net back-up software that would handle this?

Thanks for the help!

 

[MichaelCG]

Dual-Homing a standard server across both subnets pretty much negates the point of having the split VLANs with the FW in between. Don't do it.

What is your goal in separation here? Are you trying to keep your kids out of your business stuff? Or keep your business stuff out of your kids/family stuff? Why?

If you really want true isolation, you will either need another dedicated system to host your business data, or you should look into a VM server that can have dedicate NICs to each VLAN. Using the same server OS with dual-NICs across the two VLANs pretty much violates every security reason you could have ever had for splitting the networks in the first place.

If it is just a permissions issue, just route the business traffic through the FW to the server, but set share and file level permissions to keep the users where they belong. This only works if your goal is to keep the business and home people out of each other's data. It doesn't work if your goal is true physical isolation.

 

[traderyoda]

Thanks for laying this out. The "why" is driven by security requirements on the business side - I need assured isolation to keep investors happy. I worried about exactly what you brought up... separating and then trying to work inside a multi-purpose box. I'll go ahead and invest in a dedicated server. Eventually I'll move to Dual-WAN but it will take some time to install the service - that's why I built up the QOTOM pfSense box.

 

[MichaelCG]

I don't see much need for dual-WAN unless you need to make sure the source IP of your flows must be unique and/or you need unique for inbound flows. A proper FW setup should have no issue keeping them separate while sharing the same WAN.

 

[sfx2000]

Just thinking here - sounds like maybe a good use case for proxmox and setting up two VM's - one for home, and one for the business - then one can bind interfaces as needed...

https://www.proxmox.com/en/proxmox-ve