FTTH - modem - switches - routers and a mess

[ekfrasi]

Hi there,

I have the following equipment at home, as you can see in the picture.

An FTTH connection with a modem -in bridged mode - with 5 Public IPs from my ISP ( I can get more if needed)
2 switches
one unmanaged linksys (old)
one TP-Link TL-SG1016DE Easy smart switch
(and I can get more unmanaged ones if needed)


2 good routers
one ASUS RT-AC87U-wireless - supports OpenVPN
one LinkSys LRT214 Gigabit VPN firewall router - supports OpenVPN


2 old routers
an old netgear adsl one
one old TP-link with openwrt


2 Pcs wired (and sometimes more, plus various notebooks and smartphones)

1 Qnap NAS with 2 NICs

1 Dell R620 with 2 NICs

1 raspberry pi 3 (not in the diagram)

2 printers, a wired one and a wireless scanner/printer


The connection of the wired machines is via a patch panel on the wall, then to the various lan plugs in the house
----------------------------------------------------------------
Now what I am trying to accomplish is the following:

I want all computers to be able to access the printers
I want at least one PC - mine - to be able to access everything.

I want to be able to access the NAS from both the LAN and from the internet (use 1 public IP?)
I want to be able to access the various VMs from both the LAN and from the internet (use 2 or more public IPs? ) {I want to set up e.g. my own mail server and a web server with my ebooks, etc)
I want to use a public IP for VPN when I'm out, just for browsing - I did it with the Pi connected to the first switch
I want to access the NAS and the VMs via OpenVPN

--------------------------------------------------------------------------
What I have done : A total mess
(bare in mind that I have no idea about networks... some obsolete things years ago)

In the beginning I connected everything to the Smart switch - nothing worked
I used 1 Public IP to each router, one with DHCP, one without - failed
then I used one switch from the modem to the 2 routers and then to the smart switch - failed
then I found something called Vlans and I used the port based ones -made 2 - and something works! the computers one each vlan see the internet but not each other.
There is something 802.1Q Vlan & PVID setting but I have no idea.

it looks like that now

Call me a stupid old lady 😛, I think I have the hardware but no knowledge of how to set up the network.

Any help will be appreciated, BUT please explain it to me like I'm a 10 year old.

will it be modem->switch->routers->switch etc
or
modem-????/

-------------
the reason I want to used 2 routers is this
I want one for normal use in the house, wifi, printing, LAN-games, internet
I want the other for the NAS and server to access from the internet
--------------

Thanks for reading all this.
Post any solution you think that can accomplish what I want.
IGNORE what I tried up to now
If more/less hardware is needed let me know.

----------------
PS1
If you can not see the diagrams
just hardware http://i.imgur.com/gp2AIim.png
my mess http://i.imgur.com/ytAIVui.png

PS2
Excuse my mistakes in English, it is not my mother tongue
Excuse the quality of the diagrams they are made in windows paint

 

[bill001g]

Pretty much the only simple way you get this to work is to get public ip addresses for every machine you have. If you have the money that is the simple way to go.

You can not have a mix of private and public ip without some variation of the NAT problem. All your private ip would have to pass some router to get to anything you have on a public ip. If you place machines behind different router/NAT these machine can not talk to each other.

It will be a massive mess no matter what you do.


You really need to think why you really need that many public IP. You are missing a key device to doing this correctly. You need a good quality firewall that all traffic from/to the internet must pass though. This is critical if you are running any form of server...especially email server like you are talking. A NAS also is not something that is designed to be directly on the internet. You will have all kinds of traffic attempting to break into it and they are not designed to handle this garbage traffic. I would also never run things like a PI machine on a direct ip address again it will be attacked and even if it can not be corrupted the traffic alone will impact its performance.

Unless your server has to have the ip assigned directly to it it will be simpler to do 1-1 nat on your firewall and let the internal machines use the internal address to access the server.


You need to really think about why you need to do this in the first place. It is not something for a beginner to play with. If you do not know what you are doing you can easily get your network connection taken over by people doing illegal things on the internet....your ISP will not be very happy with you to say the least.

 

[ekfrasi]

The LRT214 is also a firewall and has 1-1 NAT.
My problem is to set it up.

You said " get public ip addresses for every machine you have.". Wouldn't that pose the same problem as the Pi situation you said you would never do?

My question is not so much how will I deal with the server and the VMs, it has to do with the network setup.

Thanks anyway bill001g but ...

 

[bill001g]

I said if you wanted it easy not that it is a good idea. It is the only way without learning a lot about networking.

If the lrt214 is a actual router and can accept multiple IP addresses the best option is to put all your equipment on one large lan and put in static nat for each internal machine. The LRT214 would connect between the fiber bridge and all your equipment. All your internal machine would access the equipment directly using the local ip and internet devices would access using the public ip.

There are likely other ways to set this up but this requires quite a bit of network knowledge so you know what can and can't be done. It also greatly depends on what the equipment you have can do. Most your equipment is consumer grade stuff that is missing many of the advanced features.

And I know you just want to ignore it but your servers WILL be attacked within minutes of you putting them on the network. Almost everyone including most companies is moving all the server function to hosting centers where the provider does a lot of the protection and you do not have to worry about it.