VLAN and Remote Access Questions

[arossetti]

Hello All and thanks in advance for any help provided.

I am hoping that some light can be shed on two different questions affecting the SOHO network I am building out. To answer any "Why?" questions in advance as to why I am trying this:

1) I am self taught in computers/networks but have little practical experience in implementation;
2) I just want to learn - even if I'm making this particular exercise more difficult that it needs to be;
3) I want to segment my network for security reasons;
4) Why not? - I like to tinker

Question 1 - I am preparing to deploy a media server and NAS on a separate VLAN than the rest of my network. My topology will be:

Cable Modem >> Netgear 5 Port Gigabit Prosafe VLAN capable switch >> (VLAN 1 - Server/NAS)
>> (VLAN 2 - Desktop Computer) >> (Possible VLAN 3 - Wireless AP).

VLAN 1 is Port 1 (to gateway) Port 2 (Server), and Port 3 (NAS)
VLAN 2 is Port 1 (to gateway) and Port 4 (Desktop)
VLAN 3 (if implemented) is Port 1 (to gateway) and Port 5 (Wireless AP)

To this end I understand what VLANs do and that they will not see each other unless there is a layer 3 switch or a router to communicate between the VLANs. Under this configuration, if my understanding is correct, the three VLANs should be separate and distinct networks -right?

What happens then if I share a resource between VLANs like the NAS? If my NAS is on VLAN1 and VLAN 2, and VLAN 1 gets compromised, will the hacker then have access to VLAN 2 via the shared resource?

Question 2 - My NAS is a Synology DS214 Play. It is currently deployed with remote access to the Synology DS Video application enabled. When on my LAN I can access the NAS and stream movies - no brainer there.

When on a device running over cellular, (iPad), I can access the NAS and stream movies - simple enough but why burn up my data plan.

BUT - when connecting to the NAS through another LAN/WAP I can connect to the NAS for monitoring and administration only but can not connect to stream movies. I can't even get the application to connect. Can anyone explain why a remote connection of cellular data would work but a remote connection over another LAN would not? I would think that if it was a port forwarding issue than the remote access from a cellular plan would have the same issues.

Any thoughts would be appreciated.

Thanks.

 

[boosted1g]

Quesiton 1) Yes, any device bridged accross the two VLANs would if compromised allow you to access both lans.

Quesiton 2) My first guess would be that the browser or software used on the pc on the outside network does not like the nas connection. Could be an active x or cookies or somethng dissabled. Test your phone on the wifi of an outside connection, if your phone still works just fine then it is an issue with that specific computer/application and not your network.

 

[bill001g]

I would guess the NAS is getting confused as to which IP to use.

So i am assuming the device you have you call a modem is actually a router that support multiple vlans and you have assigned it the gateway address for the three different subnets you are using. You should then be able to access the nas using its vlan 1 address from any of the other 2 vlans and the router will pass the traffic between the vlans. If you put the nas on multiple vlans I am not real sure what it will do if you would for example attempt to access the NAS using its vlan 1 address from a PC on vlan 1 when the nas also has a ip on vlan2. The traffic would likely go to the device via the router but return via the second vlan directly. If you were to access the device using its vlan 2 address from a pc on vlan 2 it should at least be consitant but you may have to configure something special to really make it work...Multihomed devices tend to be very tricky to set up