I am currently segmenting my home network into several networks and zones due to the fact that my cheap router keeps all devices (private, smart home, entertainment) in one network (without a guest network feature and client isolation).
The network contains one NAS that has a typically multi-purpose role in private networks: All relevant machines backup to the NAS and it used as a file and streaming server (exchanging files between machines, music stored on it, etc), and it hosts a very little website accessible only in the local network with some data displayed in a smart home application running on a standard smart phone (not purely for smart home use).
Naturally I would assume the NAS as something that should reside in a high security zone because it contains important data. PCs and Laptops are in the same zone. Now the tricky part: My smart-tv, my network music player, consoles and my tablets do sometimes need to access the NAS for their content, which they cannot per default because they would be in a lower zone "media zone" (e.g. I do not trust my smart tv in any way).
Are there only three solutions to that?
- Move NAS to lower security zone (into the media zone)
- Allow communication from media zone to high security zone (bad practise?)
- Get another NAS and put it into the media zone with the appropriate content for this zone and perform sync and backup tasks from/to this NAS from the NAS in the high security zone?
While the last solution would be the most secure it might not be the most viable thing to do. Are there other approaches I miss here? Has 1. a benefit compared to 2. or vice versa?
There is of course also the smart-home / IoT zone, which should basically not access anything and isolate the devices as there is no trust or control over them (could be the guest network :D)