On Isolating Storage and WiFi

Networking & Firewalls
1

Greetings all, long time viewer & supporter, first time posting here.

I’m working on revising my networking setup, and more properly segregating my VLANs and the like. Right now I have one shared management and storage vlan, where all the SMB and iSCSI targets are, as well as the only VLAN that the desktops are on, and all the management interfaces. This is of course VLAN 1 for historical reasons, and untagged on most devices and ports. The goal is to change most of that.

I have a default wifi network that, of course, my trusted devices are on. My personal laptop, my personal phone, etc. I have a separate network for IOT devices and guests that has no access to anything internal. This is the same network that my TV is on, and all my gaming consoles, and might at some point need limited access to Plex on the storage network again in the future.

So the big problem currently is that the main default and management VLAN has Jumbo Frames enabled and I’m making good use of them. I would like to keep that enabled, and segregate the storage onto it’s own Jumbo VLAN and move management to a separate Non-Jumbo VLAN that should be the default for the trusted devices, laptops, etc. Again, separate from the IOT and Guest devices. Again separate from the Dev and Srv and Free Wifi VLANs, which really only kinda matter a little here, but not for this question.

The question is, if the storage is exported primarily and exclusively in a VLAN with Jumbo Frames enabled, How do I access it from the desktops with the default VLAN, which is the same as the Laptops on WiFi? On the desktops, all of which have 56GbE cards, I can just set up two VLANs on each system and place one in storage and one in default and call it a day, but that requires that I manually configure each system, and it’s no longer as easy as just plug in the MPO cable and go.

Moreover, I can’t do that at all on WiFi at all. I searched through every single setting in my unifi controller for an MTU or MSS setting for the Wireless AP, but couldn’t find any anywhere. Secondarily, I can’t, to my knowledge, instruct my Windows 10 or Linux desktops to authenticate to two different WiFi networks at the same time. If I try to connect to a second. it disconnects me from the first.

This basically brings me back to wanting to just use the same Storage network as the default network and the management network, and continue to isolate the externally accessible systems in IOT, DEV, SRV, and FREE vlans. Because I actually see a noticable difference from my desktop to my storage server in my game load times when Jumbo Frames is enabled.

That still doesn’t solve the WiFi MTU problem though.

Ultimately these are the basic constraints, and I can’t find a solution to satisfy them all, and any help or advice would be appreciated:

Desktops and WiFi Laptops in same Broadcast domain
Desktops and Storage in same Broadcast domain
WiFi Laptops and Storage in same broadcast domain
Storage over MTU 9000
WiFi has no apparently settable MTU settings.

2

There is not really a simple solution other than having two physically separate networks or give up jumbo frames. Jumbo frames are really not that dramatic of a speed boost.

3

Even with two separate networks, storage still gets routed to the laptop systems.

Is it even theoretically possible to set MTU on a WiFi network? If so, how?

I’ve run into issues sharing SMB between windows PCs across VLANs too. By default windows will only share with the local broadcast domain. This and steam in-home streaming, is specifically why I want the trusted WiFi devices and the Desktops in the same broadcast domain/VLAN.

Is there any easy way to tell windows to accept SMB connections from all the trusted subnets without requiring significant time to sit down with each Windows PC and tweak a bunch of firewall and sharing settings? I haven’t even tried accessing Steam across vlans, though I assume there’s a solution similar to avahi that would let me cross that bridge easily.

4

There are probably some group policy settings that would allow that to be automated in Windows, but that is not my field of expertise.

5

What about MTUs on WiFi? Aware of any options surrounding that?

6

There might be a way, but getting all the clients configured for that would be even more tedious. We almost never use Jumbo frames for production system to avoid the potential issues with them.