Set Up of a NAS in a private subnet

I have a Linux server with the only Ethernet card in a corporate network. I also have a NAS which cannot be connected to the same corporate network. Here are the steps on how one can set up a private subnet to connect a NAS and Linux server in a way that makes the NAS accessible only from the server, while keeping it isolated from the rest of the corporate network.

Part 1: Set Up Private Subnet Between Fedora Server and NAS.

On Fedora Server:

1. Create a virtual IP interface for the private subnet:

sudo ip addr add 192.168.100.1/24 dev eno1

Replace eno1 with your actual NIC name (check with ip a if unsure).

2. Verify:

ip addr show eno1

You should now see:

Corporate IP (my urania IP)
192.168.100.1 (private subnet)

On QNAP NAS

For eth1 (LAN2):

IP: 192.168.100.2
Netmask: 255.255.255.0
Gateway: 192.168.100.1 (your Fedora server)

Ensure:

eth0 (LAN1) has no default gateway or set lower priority. I used 0.0.0.0

Connect both server and NAS eth1 to the same switch.

Part 2: Enable Internet Access for NAS via Fedora Server.

On Fedora Server:

1. Enable IP forwarding:

echo ‘net.ipv4.ip_forward = 1’ | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

2. Enable masquerading in firewalld:

sudo firewall-cmd –zone=public –add-masquerade –permanent
sudo firewall-cmd –reload

3. Add NAT rule to masquerade private subnet traffic:

sudo firewall-cmd –permanent –direct –add-rule ipv4 nat POSTROUTING 0 -s 192.168.100.0/24 -o eno1 -j MASQUERADE
sudo firewall-cmd –reload

Replace eno1 with your actual NIC name (check with ip a if unsure).

Now the NAS will get internet access via the server — try pinging 8.8.8.8 from the NAS.

Part 3: Allow Other Corporate Devices to Reach the NAS via my Fedora Server.

If you control another machine (it’s our case), you can add:

route add -net 192.168.100.0/24 gw [my urania IP]