Question NAS isolation from internet, and VLANs

[VirtualLarry]

Here's what I want to do. I currently have some D-Link web-managed switches, and a mixtures of un-managed switches. What I'm planning on doing, is replacing the switches on the NAS and the workstation end with Zyxel 12-port (8x 1GbE-T, 2x 2.5GbE-T, and 2x 10GbE SFP+) switches, and I'm leaning towards getting the web-managed version for $200+, so that I can (hopefully) implement this.

I want my multiple NAS units, each (mostly) with multiple NICs, to be isolated to a "NAS VLAN", which the workstations would have access to, as well as having the workstations access to the internet connection (Gigabit WAN). The workstations currently have both a 2.5GbE-T and a 1GbE-T (one on USB3.0, because the onboard LAN burned out).

I plan on having a separate sub-net for each VLAN as well (which, in theory, could be enough, but I'm concerned enough about access issues that I want them actually VLAN'ed off at the switches as well).

I also want the ability to (temporarily) bridge the "internet" VLAN with the "NAS VLAN", to allow the NAS units to pull firmware updates. This may necessitate enabling the secondary 1GbE-T LAN connection on each NAS, allowing it to obtain an IP and gateway, and then do a search for firmware updates, or possibly, I could actually physically plug in a cable to bridge the VLANs (if port-based on switch), or possibly, I could simply bridge the two connections on my main workstation (temporarily), allow the NAS units to do firmware updates, and then disconnect the bridge.

Note that my NAS units were previously hacked through DNS hi-jacking of their (otherwise presumably local) domain names, and the data exfiltrated, so I want to enact some stricter policies in place to prevent that ever happening again.

Note that QNAP and Asustor have "helper apps" that run on the workstation, that can assist in configuration, and firmware updates (at least for QNAP, haven't checked Asustor), that could, in theory, if they pull the firmware version from the NAS (on the separate NAS VLAN, that the secondary adapter on the workstation has access to), and compare it with the "current release" firmware version (that would presumably go out on the "internet VLAN" on the workstation to check, and could then download and (with the proper password applied in the program) do the firmware update to the NAS semi-remotely.

Even if that "helper app" could ALERT the admin to a new firmware version being available, and then link to download it, and then allow the admin to manually connect to the NAS via the "NAS VLAN" and NIC, and upload/install the firmware that way, that would be acceptable too, and I wouldn't have to bridge the VLANs, even temporarily. That would probably be the BEST solution.

Assuming that scenario, in which the NAS units were: 1) on a separate subnet, with static IPs, and 2) on a separate NAS VLAN (hence no need for a default gateway or DHCP server either), how hard would that be to set up?

Just consider the default VLAN to be the "internet VLAN", and set up a VLAN ID for the "NAS VLAN", and assign those physical ports that the NAS NIC(s) are plugged into, to the NAS VLAN?

I need to have my two Zyxel managed switches "trunked" together over a 10GbE-T link to each other, and then have similar port-based VLANs assigned, for the two physical NICs in my workstations, the 2.5GbE-T NIC getting assigned to the "NAS VLAN", and the other 1GbE-T NIC set to the default VLAN and connecting to my router and DHCP server?

 

[dailow]

It sounds like the helper app is honestly the best way to secure your NAS, with the caveat that the workstation needs to have a NIC that's directly connected to the NAS VLAN/Subnet.
This way your NAS won't have a default gateway and would only be reachable from within the NAS Subnet, but the main drawback is that all of your clients would also need to have an IP in the NAS subnet.
You can get around that by establishing routing between your various VLANs, but you would have to block the NAS VLAN from being able to access the Internet at your router if it has that capability.

Another alternative - connect the second NIC on each NAS to the Internet VLAN but leave those ports shutdown on the switch.
Then you manually enable the ports on the switch whenever you want to check for a firmware update, but I can already tell you that this is going to be a pain.

Also, something to watch out for - make sure all of your switches support VLAN tagging.
Consumer switches handle VLAN tags with varying degrees of consistency.

 

[SamirD]

I think you've got a solid plan, but the biggest question is how the nas units got hacked in the first place?!?

If you really want safety, forgo vlans and go with physically separate lans using dual nics on all the workstations to connect to the internet and the nas lan separately, only bridging them when you need the nas units to update--or do as I do and manually download the nas update locally and then execute the update via the nas with the local file.

 

[mxnerd]

Putting NAS machines on a separate VLAN requires a router between different VLANs.

And if you want 10Gb speed between VLANs, you probably also have to build the router with dual 10Gb NICs youself.

 

[mxnerd]

I think you've got a solid plan, but the biggest question is how the nas units got hacked in the first place?!?

The incident VL was talking about. It's not hacked, it's just Verizon doing the shady things.

URGENT - been hacked, they've been MITM'ing my NAS units on my local LAN.

Interesting technology. I've got some NAS units, "TS-431" and "TS-451". AFAIK, they register in local (router) DNS when booted, with their names. Which, to my knowledge, should be accessable, via "http://ts-451./" , etc. Well, It seems that somehow, my router has been compromised (likely a...

forums.anandtech.com

There is no way who on his computer types http://ts451./ will redirect the traffic to VL's router/NAS.

 

[SamirD]

The incident VL was talking about. It's not hacked, it's just Verizon doing the shady things.

URGENT - been hacked, they've been MITM'ing my NAS units on my local LAN.

Interesting technology. I've got some NAS units, "TS-431" and "TS-451". AFAIK, they register in local (router) DNS when booted, with their names. Which, to my knowledge, should be accessable, via "http://ts-451./" , etc. Well, It seems that somehow, my router has been compromised (likely a...

forums.anandtech.com

There is no way who on his computer types http://ts451./ will redirect the traffic to VL's router/NAS.

Wow, that's just nuts! Another reason to use your own router I guess.

It's really amazing why isps are going out of their way to do things like this. Comcast/xfinity with their 'hotspot' aps and then this from verizon...

 

[Stuka87]

As kind of mentioned above, you cannot route between VLAN's using a Layer 2 switch. It would require a router, or a Layer 3 switch. Neither of which will be cheap for 10Gig ethernet. You can get older 1Gig cisco/juniper routers pretty cheap. But I think this may be way slower than you want.

But, provided you had something to route between the VLANs, what you want to do is quite easy. All your workstations could access the NAS, but the NAS could not access the internet GW.

Now, you could kind of do the same thing if your workstations all have more than one NIC. Then you could have one be on the same subnet as the gateway router, and the secondary NIC would be on a different subnet that things like your NAS are on. This way your workstations can hit both, but the NAS can't hit the gateway router because its on a different subnet.

 

[mxnerd]

Wow, that's just nuts! Another reason to use your own router I guess.

It's really amazing why isps are going out of their way to do things like this. Comcast/xfinity with their 'hotspot' aps and then this from verizon...

Just don't use ISP's DNS. Use public DNS like Google's 8.8.8.8, 8.8.4.4, Cloudfllare 1.1.1.1, 1.0.0.1 or Quad9 9.9.9.9 , or Level 3 4.2.2.1 - 4.2.2.6

Charter's DNS is doing something similar to Verizon for many years already.

 

[VirtualLarry]

Now, you could kind of do the same thing if your workstations all have more than one NIC. Then you could have one be on the same subnet as the gateway router, and the secondary NIC would be on a different subnet that things like your NAS are on. This way your workstations can hit both, but the NAS can't hit the gateway router because its on a different subnet.

That's basically what I'm planning, but also to have a switch port-enforced VLAN for the NAS, besides being on a separate subnet as well.

Edit: The workstations already have two NICs, a 2.5GbE-T (which would be re-purposed for NAS access), and a 1GbE-T (usable for internet, I have a 1Gbit/sec WAN connection).

 

[SamirD]

Now, you could kind of do the same thing if your workstations all have more than one NIC. Then you could have one be on the same subnet as the gateway router, and the secondary NIC would be on a different subnet that things like your NAS are on. This way your workstations can hit both, but the NAS can't hit the gateway router because its on a different subnet.

Since the issue to avoid is more of a software thing versus a full blown attack of some sort, this is the approach I would take.

 

[SamirD]

Just don't use ISP's DNS. Use public DNS like Google's 8.8.8.8, 8.8.4.4, Cloudfllare 1.1.1.1, 1.0.0.1 or Quad9 9.9.9.9 , or Level 3 4.2.2.1 - 4.2.2.6

Charter's DNS is doing something similar to Verizon for many years already.

Ah yes, I forgot to mention their shenanigans. I've either had accounts or have accounts on all these isps--changing the dns years ago solved a lot of problems.

 

[SamirD]

That's basically what I'm planning, but also to have a switch port-enforced VLAN for the NAS, besides being on a separate subnet as well.

Edit: The workstations already have two NICs, a 2.5GbE-T (which would be re-purposed for NAS access), and a 1GbE-T (usable for internet, I have a 1Gbit/sec WAN connection).

If you're pretty much doing this anyways, I would just pick up a physical switch and go full physical separate network. So you enable nas internet access by plugging in a cable to the internet or enabling/disabling a port that would be connected to the internet.

The only reason I mention this is when I looked into hacking vlans years ago there were methods to spoof the tags, and I'm guessing it is much more sophisticated today to the point it is usable for hacking.