How DO I lock down a media receiver?

[Busto963]

How do I solve this conundrum?

I created two VLANs, one wired, and the other wireless (on a DMZ) and thought I was pretty well off by keeping my wireless devices isolated from the wired network.

My wifi VLAN is running on an older mac Airport extreme base station with just three ethernet ports, one of them used to connect to another airport express to create a wifi "roaming network".

Now, I have two media receivers which require ethernet to play 24 bit /192khz audio files stored on a media server. The problem is that I now want to use an ipod/iphone/ipad as a DLNA access control point for the media receiver using wifi.

The only way I can see around this is to move my UPnP server and the media receivers over to the wireless VLAN by hooking them up to the router using ethernet. I am not thrilled about doing this. I am out of ports on the Airport extreme meaning I need a new router or switch. I will also have to figure out a new backup solution every time I add music or video as I had my current backup is set-up through the LAN. More importantly, I really want to keep the two VLANs isolated for security.

Is there a better solution to than shifting the media server and media receivers to the wireless side of the network?

 

[jtherkel]

My short version is, "No, I don't know a better solution."

I'm not an expert, but I did consider the same issues, which is why I'm posting. Here's the thought process I followed.

1) I run the media server that's baked into the D-Link DNS-323 NAS. This is probably more lightweight than what you use.

2) When I first started researching current NAS's, I thought, "Oh, I need a 4-drive NAS running RAID 5 or RAID 10. And I should probably have another as a backup. And it would be nice to have a third for media only."

Unfortunately, I cannot afford two or three $800 NAS's. Then I read this article.

Smart SOHOs Don't Do RAID
http://www.smallnetbuilder.com/nas/nas-basics/30060-smart-sohos-dont-do-raid

It changed my outlook. I *can* afford 2-3 single drive NAS devices. (I chose the Western Digital My Cloud 2 TB.)

3) My goal is:

* One "media" NAS on the same VLAN as my wireless clients. This drive only contains music, videos and vacation photos.

* One private NAS that contains personal files, including anything with financial info. The private NAS sits on its own VLAN, accessible only via Ethernet.

* A backup NAS (not purchased yet) that will also sit on the private VLAN and will back up the other 2 NAS's. The backup NAS will *pull* files from the media NAS.

I accept that my media resides on a less secure VLAN, but that's what I have come up with after much research on this site.

HTH,
John

 

[stevech]

Why not a $175 2-bay NAS + 2 ordinary drives?
Synology and QNAP both have low cost 2 bay NASes. I have a 2 bay. More than adequate but I'm not a video-ripper.
Non-RAID.
Two volumes.

 

[jtherkel]

The article mentions a few worst-case scenarios.

[...] the controller board in my RAID 5 NAS went belly up [...]

But what if I had been using the NAS as my primary file store? Or been burglarized? Or had a fire or unexpected flood? All of those wonderful RAID parity bits would have been useless because they were all part of the same box.

This got me thinking about likely scenarios in my home environment. I use the NAS for primary file storage, and theft is a possibility.

I can afford a few cheap, single-drive NAS's and place the backup NAS in a hidden location. With a little more money, I would have used three two-drive NAS's (media, private data, and backup) running RAID 1, with the backup in another location. For cost reasons, I settled on three single-drive devices.

-John

 

[stevech]

I use USB3 for anti-theft backup. Drive is in non-obvious place.

IMO, theft is probably the greatest risk to the home NAS.
On line backup: not viable due to most of our uplink ISP speeds. You can mail a drive to them, but that's $150 or so with most. May as take it to a friend.

 

[TD93103]

My first thought would be to go get a older router or APexpress, configure to wireless bridge. Put in same room as distribution and connect reciever and server to the WiFi bridge via Ethernet. Otherwise you would have to get iPad on wired network and that wont happen.

There must be ways to get this done with static routes. If your router supports it.