Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[rarewolf]

I'm seriously considering this storage for a university lab environment.  However, ideally it would have 2 NICs:

(1)  1000mb/s connection to computer that acquires the data, but which cannot be on the university network.
(2)  100mb/s connection to the university network, configured for secure and privileged users.

It just occurred to me that a router my suit these requirements(?)  Please advise ...

TIA 

[jamieburchell]

I'm seriously considering this storage for a university lab environment.  However, ideally it would have 2 NICs:

(1)  1000mb/s connection to computer that acquires the data, but which cannot be on the university network.
(2)  100mb/s connection to the university network, configured for secure and privileged users.

It just occurred to me that a router my suit these requirements(?)  Please advise ...

TIA 

Could you plug the PC and NAS in to a gigabit switch, connected to your uni network and deny access to the PC with firewall rules?

[rarewolf]

Could you plug the PC and NAS in to a gigabit switch, connected to your uni network and deny access to the PC with firewall rules?

Sounds similar to a router remedy ... sorry to be such a noob ... could you point me at an example of a "gigabyte switch"?

[gunrunnerjohn]

Here's a whole bunch of them.

http://www.newegg.com/Product/ProductList.aspx?Submit=ENE&DEPA=0&Order=BESTMATCH&Description=5+port+gigabit+switch

[rarewolf]

Here's a whole bunch of them.

Thanx 

Another noob-y question ... of the 7 of them that are actually switchs, what does it mean that their "network management" is either managed or unmanaged, and why does "managed" increase the cost by $1000?

TIA 

[fordem]

An unmanaged switch will just provide the basic switch functionality.

A managed switch has the ability to monitor a number of network usage parameters and report these to a management station which can then alert you to potential problems, hopefully before they become full blown network failures.

Most managed switches will also have additional features that allow for redundant links (LAG/Trunking/STP), added security (VLAN/802.1x), etc.

Managed switches are more expensive than an unmanaged switches because they must have the "intelligence" required to perform the management tasks.

[gunrunnerjohn]

Very few home users will have any use for managed switches or can justify the expense.

[dosborne]

Often, a second router is a cheaper solution. I run 3 routers and 2 unmanaged gigabit switches on my home setup.

[OlegMZ]

I'm seriously considering this storage for a university lab environment.  However, ideally it would have 2 NICs:

(1)  1000mb/s connection to computer that acquires the data, but which cannot be on the university network.
(2)  100mb/s connection to the university network, configured for secure and privileged users.

It just occurred to me that a router my suit these requirements(?)  Please advise ...

TIA 

2 NIC host between secure and insecure network segments is not a good idea...unless it is firewall  

All guest hosts should be placed into separate "guest" network which should be separated from secured network with firewall. Connectivity between segments should be tightly controlled on firewall by opening necessary ports  to specified segments or hosts. Ideally there should be dedicated DMZ subnet to which firewall will control access from both secured and unsecured segments and hosts on the DMZ should have no or very limited access to other networks. Idea is - if someone breaks into host on DMZ (say your web server) it will not be able to access anything else from it.

If you want cheap solution the easiest (but not the most secure) is to take some 1G capable LAN/WAN router like Dlink DIR-655. You do not need wireless, so if it is possible to find some consumer grade inexpensove wired-only 1Gb router with built-in firewall capabilities - it is fine. Otherwise just disable wi-fi right away.

Common idea is to treat your insecure PC and your NAS as internal home LAN and treat your university network as external WAN network (ISP connection).

Now you connect this router with its WAN port to your internal secured network, and assign a static IP from that network to this (WAN) port, including mask and default gateway.
Make sure that internal (LAN) address space of your router is not overlapped with "WAN" (university) subnet.

Next step is to plug your NAS and "insecure" PC to LAN ports of your router and (preferably) configure NAS IP as static. Since that moment all PCs on your router LAN will be able to communicate to NAS and TO ALL YOUR SECURED NETWORK (a bit of a problem here!!!) as the router will be NAT-ing they packets to its WAN IP.

Now all you need to do to allow devices on your university network to access NAS is to create static NAT translations from your university network back to IP of your NAS box as you would if you planned to access your FTP or HTTP server on NAS at home from the internet.

All devices on university network will see the router and NAS as one of hosts on internal network, so there is no problems with routing.

But there are problems with security, because instead of protecting secured network from insecure PCs you in fact protect them from hosts on university network. You could fix this if the router was able to set some kind of incoming access-list on its LAN interface (in LAN to WAN direction).
BTW what PROBABLY might work is if you create static NAT rule to fully translate your router public (WAN) IP to NAS IP (not port by port but full IP), although I do not know if it will let you do so.

You could "rotate" the router, setup it in opposite direction and use 1G switch for NAS and PC, but there will be some routing problems in this case.

Anyway security in this case is another problem and you'd better consult with university network admins before doing anything. Normally rogue devices are not allowed as may introduce security breach  


 

[rarewolf]

Thank you OlegMZ!!