DSM 7.2 VLAN Question (Implementing in an operational System)

[Jan Janowski]

System here fully operational for years, but has hardware scattered in various rooms, Connected together by Patch panel in each room... or in garage, and all tied together in computer room panel and un-managed switch.. And all devices presently on a single subnet..
All switches are un-managed.. Router is 2600

Considering VLAN but have a couple questions....

Can I separate the VLAN groups by LAN Connection ports on the Router?
Nothing (ever) connected to LAN1
IOT devices on LAN2: Most but not all devices blocked from internet, (Security Cams, other Stuff I want isolated).. no access to any other group, but Main Gear can access this...
Media gear on LAN3: TV's Media Players, etc. Access to internet from All gear here allowed: No access to other groups, but Main gear can access this.
Main Gear on LAN4: Computers, NAS's Phones, Printer...Router.... WIFI Static IP's and DHCP is in this group, too, but Firewall in NAS's blocks DHCP WIFI's from NAS... Access to internet and all other groups...

If the above is possible, My questions:
1. Seeing I'm separating by Router LAN ports, can I leave all IP's where they are now, On a single Subnet?
2. Say I want to give individual WAN Ping or Internet access to one or more devices on the IOT group.... can this be done with a Rule in the firewall?

I'm hoping to NOT Change IP's as device configurations, Firewall's in Router & NAS's, along with Many custom rules in TP would make this very complicated...

IF All this is possible, I can then Start determining what I need to add in CAT6 Lines to rooms so as to break out hardware into 3 groups per room and then having 3 UN-managed group switches by router that would then feed 3 Router LAN's as a VLAN...

Do-able? Thanks..

 

[fredbert]

Can I separate the groups by LAN Connection on Router?

What's a group?

VLANs are LANs that can shared the same hardware. Like LANs, VLANs require routers to enable different VLANs to communicate. Each VLAN and LAN has its own address space, or IP subnet. In the theoretical, LANs and VLANs can occupy the same address space but the connecting routers need to be able to handle this if this happens within the same physical environment. In this case, the router or firewall would have to support trust zones and virtualised processing (Fortinet calls this VDOMs), so that the path between two LANs/VLANs goes through stages that can translate sources and destinations: a destination IP to another LAN/VLAN must not be to a local LAN IP, because this would never get to the router. Obviously, when it iis between LANs/VLANs that a physically separate then this just needs NAT to happen to the source and destination: this is what happens where most of the Internet private address space is using 10.0.0.0/8, 192.168.0.0/16, etc.

In the SRM router each private network (VLAN) will have it's own unique addressing. If you move devices from a single flat LAN to two VLANs (say, primary and guest) then those that are moved to another VLAN will need/get new IP address, based on that VLAN's IP subnet.

I would test this first before going all-in. The apps and services that rely on discovery may no longer work, or work reliably, across VLANs. Some might implement their discovery mechanism, that should be able to be relayed, but do so with assumptions that the subnet will be unchanged.

 

[Jan Janowski]

OK, If IP addresses must be changed, That's hundreds of changes: far too complex to try and convert everything... Was hoping I could do it by Router LAN connection.. and pre group all identical devices into 3 paths, so no Smart switches would be necessary... Thanks for the correction...
(Group was the 3 planned device lists)

 

[jra11500]

Having everything on a single subnet is not a good idea and I have done the following here for my networks and devices:

Network 1: Primary network (untagged) - for computers, NAS’s, phones, printers, etc.
Network 2: Guest network (VID:1733) – normally not used. Wi-fi is off.
Network 3: IoT network (VID:3) – for lights, controllers, etc.
Network 4: Camera network (VID:4) – for IP cameras and associated hub
Network 5: TV network (VID:5) – for TVs, FireTVs, and Echo devices

All my router ports are configured as trunk ports. In your case, it is possible to configure the router’s LAN ports (except for port 2 which is reserved for the primary network) for an individual VLAN which could then feed your unmanaged switches.

If most of your devices use DHCP, then reconfiguring IP addresses should be relatively easy. The router’s DHCP server can provide the addresses to all the subnets and also handle address reservations for each subnet.

WRT pings, etc., you will have to set up the necessary firewall rules and the Synology site has all the info you need so devices can access other devices on a different subnet.

In closing, I would recommend using smart switches instead of unmanaged switches. Switches, such as the TP-Link SG108E, are relatively inexpensive and would allow you to trunk all the VLANs to a particular room or location (with one cable) and then would allow for device connections to any network.

 

[Jan Janowski]

if I was starting fresh, and didn’t have multiple un-managed GB switches, yes. But things are IP set and operational now without VLAN.
Keeping system as close to 100% operational is not an option, it’s a necessity.
I was hoping to group identical hardware scattered around the house, in the 3 groups, using 3 unmanaged Switches to bring all the same group hardware into one- each feeding the 3 LAN Ports, and use firewall rules to allow the few IOT Devices to WAN PING & internet… but no. Changing 25 or more IP’s, their settings and interconnects within other settings, and those in other devices, and a hundred or so TP custom rules is Not a quickly accomplished option! It’s an ISSUE, fraught with errors.

Maybe if I was starting fresh. All new gear. Ground up. Yeah.

Remember: System is up & fully operational now, and except for a brief VLAN configuration, needs to be up & operational the next day, with VLAN too! I don’t see VLAN as a simple upgradable option for an existing system. Only new systems. I keep trying to discover a way of doing VLAN, to gain it’s benefits, and keep running into roadblocks preventing its implementation.

 

[Jan Janowski]

So.... After going through still another round of reading VLAN Docs and installation notes: Synology and other places.... I keep encountering the same roadblock... So I ask here....

How did others with a fair amount of hardware, multiple firewalls (router & 3x NAS's) pretty much all devices with fixed IP and a massive amount of Software Settings with existing IP's in them........... Convert and existing operational single subnet system.... to a VLAN system, and stay operational during the change over? It doesn't seem possible...

Has anyone done this, and can provide some hints on how it was done?

 

[Pauljw]

I realize that this is "off topic" , but is there a chance that somewhere in your digging around in all those settings you could locate the one for that annoying animated avatar and turn it off?

 

[Jan Janowski]

Been using that for about 15 years.

On other fronts, seeing that I’m shelving VLAN altogether, experimenting with firewall rules. Learning via those. Love ‘hits’. Wish NAS had them! So much for feature request done 5+ years ago!

 

[Pauljw]

That doesn't make it less annoying, thanks for clarifying... option 2 implemented.

 

[Jan Janowski]

Glad to see you found a conclusion to that. That avatar has been part of my life for what seems forever. Long since my 2 wheeled life was over.

 

[Jan Janowski]

And as a follow up-getting re-acquainted with wireshark. It’ll take some time, but I’m willing to learn..

 

[Telos]

That doesn't make it less annoying

If you block a user, you won't see their avatar (or whatever that thing is).

 

[Pauljw]

If you block a user, you won't see their avatar (or whatever that thing is).

Yep, that's what I meant when I said option 2 implemented, I blocked him....

 

[Jan Janowski]

Continuing on with trying to implement VLAN, discovered a recent Synology change that put an end to any thoughts of VLAN implementation here.

7.2.2’s removal of Surveillance Station’s use of SS as a Motion detect source, and my use of that on All Licensed cameras: With 7.2.2 — As long as pre 7.2.2 existing SS licensed camera’s settings are not altered within SS - existing licensed applied cameras configured for SS as a Motion detect source remain fully operational….. in 7.2.2.
And I’d have to edit each licensed camera in SS to change the IP of that camera as part of the VLAN implementation. That would Remove SS as a Motion detect source.
This would force the use of camera motion detect, which is nowhere as good as SS was for motion detect.. causing more false recordings due to motion detect that is less accurate, causing greater disc usage, further exasperated by loss of H265…

Damned if I do…. Damned if I don’t!

Well, this puts an end to VLAN consideration! And end of license purchases! Nuts!