I have a router (ccr) that has two SFP+ ports and multiple ethernet ports. Three of the ethernet ports are setup as direct VPN access with a different network subset and no access to the home network. I use the windows 7 computer connected to the VPN port as a download server. I'm trying to figure out if I can get unraid to look at the download server copy the files over to the unraid media share. 

 

Because I have switches with open SFP+ ports I'm going to utilize them for 10GbE speed. 

 

Move VPN connection from the ethernet port to one of the Mikrotik ccr sfp+ ports. Connect Cisco sg350 SFP+ to the other ccr SFP+ port. Connect Cisco sg500x to sg350 via sfp+. Connect the unraid storage server to open sfp+ port on sg500x. There is no layer 3 switching on the cisco switches. The mikrotik is doing the routing and switching. 

 

I need to be able to access my VPN download server from my workstation (10 Gbase-T connection to Cisco SG350) so I've been told to use Remote Desktop and have a rule on CCR router that only allows traffic from workstation to the RDP port on VPN download server for control instead of using teamviewer. I think I can figure this out myself. This would allow me to control the VPN download server but not transfer any files from the VPN download server to my workstation I think??

 

How to I setup a share between the unraid storage server and the VPN download server? Both are on separate subnets and there are firewall rules preventing the VPN download from accessing anything on the home network subnet. I think I have to modify the firewall to allow the unraid server access to the VPN download server via LAN without exposing it to the VPN internet traffic - need to study more Router OS to figure this out. If the firewall gets modified correctly then I should be able to use the unraid krusader docker to mount a share of the VPN data drive?? What makes more sense - mounting the share on the unraid server or on the download Server (windows 7)? I'm really not sure what to do here and don't want to invest a few thousand dollars in building a new unraid server without knowing if it is possible. 

 

Thanks for your advice

2 basic choices:

1) set up rules on the firewall to allow traffic across subnets (poke a hole)

2) put a 2nd NIC in the unRAID machine and have it connected to the same network/subnet as the download machine (spaghetti)

 

11 hours ago, sota said:

2 basic choices:

1) set up rules on the firewall to allow traffic across subnets (poke a hole)

2) put a 2nd NIC in the unRAID machine and have it connected to the same network/subnet as the download machine (spaghetti)

 

Which is the safest? If I accidentally download malware/randsomware and it gets past the scanning software, would either of the two suggestions protect the main server and netetwork? Is is possible to setup the connection as one way traffic where the unraid pulls content instead of the VPN download server pushing content?  

a pull would be safer than a push, in terms of a direct attack.  as you've surmised, if legitimate traffic can get in, then illegitimate traffic can also.  however an undetected payload is still a problem, regardless.

 

In the past year I've made the mental "switch" from prioritizing defense AGAINST infection, to prioritizing mechanisms to recover FROM infection; techniques of getting malicious code onto systems are getting significantly more sophisticated to the point of it's not a matter of IF you're going to get hit, but WHEN.  How do you recover from the inevitable has become more of my focus than it was in the past.

Sadly, I can speak from experience, of getting bit by a ransomware attack, and having it somehow (still haven't figured out how it did it) encrypt my Exchange Server databases, but nothing else.  I recovered totally though.