Synology Disk DS211J

Sat Oct 1 03:31:09 UTC 2011

On 09/30/2011 08:56 AM, Blake T. Pfankuch wrote:
> The easy way around the unhappy significant other/minion shaped offspring solution is to put all of the "end user" devices On a separate VLAN, and then treat that as an open DMZ.  Then everything operational (ironic in a home) on your secured production network (restrict all outbound/inbound except what is needed).  If you really want to complicate it you should even put your wireless into a separate VLAN as well, and secure it as appropriate.  Gives you the ability firewall between networks, thus making sure that when your minions eventually get something nasty going on the PC they use, it doesn't spread through the rest of the network.  Also means you can deploy some form of content filtering policies through various solutions to prevent your minions from discovering the sites running on the most recent TLD addition.  

Packet fence. Per user vlans. RADIUS back end auth with one time
passwords. I'm trying to package all this into a turnkey distro for my
own deployment across hundreds of sites. As such I need it anyway and
don't mind open sourcing it. It's been an on again/off again project but
it's really close to release.

> This assumes that most people reading this email have the ability to run multiple routed subnets behind their home firewall.  Be it a layer 3 switch with ACL's or multiple physical interfaces and the ability to have them act independently.  

Routing on a stick to pfSense for me. Though I could use my l3 switch I
guess. *shrugs*

> Personally I run 8 separate networks (some with multiple routed subnets).  Wireless data, management network, voice networks, game consoles, storage, internal servers, DMZ servers and Project network.  Only reason why there is no "end user" network is that there are no wired drops anywhere in the house, so that falls under the wireless data. That network gets internet access and connectivity to file sharing off the internal servers and all internet traffic runs through Anti-Virus/Anti-Spyware before going outbound and inbound.

No. You aren't paranoid enough. See above. If it was turnkey, more
people would use it.

> Blake
>
> -----Original Message-----
> From: Matthew Palmer [mailto:mpalmer at hezmatt.org] 
> Sent: Friday, September 30, 2011 12:19 AM
> To: nanog at nanog.org
> Subject: Re: Synology Disk DS211J
>
> On Thu, Sep 29, 2011 at 07:10:10PM -0700, Joel jaeggli wrote:
>

-- 
Charles N Wyble charles at knownelement.com @charlesnw on twitter

http://blog.knownelement.com

Building alternative,global scale,secure, cost effective bit moving platform
for tomorrows alternate default free zone.