🛠 NAS Samba sur NVMe avec VLANs de gestion

Objectives

Leverage the M.2 Key-M slot (2280, PCIe 2.1 x1, NVMe) on the NanoPi R5S to build a fast Samba NAS, while isolating management traffic via 802.1Q VLANs on the LAN bridge. You will combine: mounting the NVMe with ext4, hardening the Samba share, creating VLAN sub-interfaces on the bridge (br-lan.10 for data / br-lan.20 for management), and setting up filtering rules between zones. Requires an upstream managed switch.

Hardware

• NanoPi R5S with an M.2 2280 NVMe SSD (the slot is PCIe 2.1 x1: capped at ~500 MB/s, well above 2.5GbE speeds)
• Debian/Ubuntu or Armbian; managed network switch with 802.1Q trunking on the R5S port
• USB-C PD power supply ≥ 10 W (the NVMe adds power consumption)

Complete Code

#!/bin/bash
# 1) NVMe : formatage (ATTENTION efface tout) + montage persistant
lsblk ; mkfs.ext4 -L nas /dev/nvme0n1   # vérifier le bon disque AVANT
mkdir -p /mnt/nas && blkid /dev/nvme0n1
# /etc/fstab : UUID=... /mnt/nas ext4 defaults,noatime 0 2
mount -a

# 2) VLANs sur le bridge LAN (switch amont en trunk 10,20)
ip link add link br-lan name br-lan.10 type vlan id 10
ip link add link br-lan name br-lan.20 type vlan id 20
ip addr add 192.168.10.1/24 dev br-lan.10   # données
ip addr add 192.168.20.1/24 dev br-lan.20   # gestion
ip link set br-lan.10 up ; ip link set br-lan.20 up

# 3) Samba durci sur le VLAN données uniquement
apt install -y samba
printf '[nas]\n   path = /mnt/nas\n   browseable = yes\n   valid users = nasuser\n   create mask = 0660\n' >> /etc/samba/smb.conf
systemctl restart smbd

# 4) Isoler la gestion : le VLAN 20 ne sort pas vers WAN
iptables -A FORWARD -i br-lan.20 -o eth0 -j DROP
iptables -A FORWARD -i br-lan.10 -o eth0 -j ACCEPT

Expected Verification

lsblk shows the NVMe mounted on /mnt/nas; smbclient -L //192.168.10.1 -U nasuser lists the share. From a client on VLAN 10, write transfers reach several hundred MB/s (PCIe 2.1 x1 limit ~500 MB/s, consistent with 2.5GbE at ~280 MB/s). Pinging between VLAN 20 and WAN fails (DROP rule) while management SSH works. ip -d link show br-lan.10 confirms the vlan id 10 encapsulation.

Common Errors

• Formatting the wrong disk: always check lsblk and the size before running mkfs.ext4; eMMC and microSD are also candidates.
• Misconfigured trunk on the switch: without a port in trunk mode allowing VLANs 10 and 20, the sub-interfaces will receive no traffic.
• Forgetting noatime and user quotas: eMMC wear is no longer an issue since we are writing to NVMe, but Samba logs can fill up the system — log them to the NAS.
• Sharing on all ports: bind Samba to the intended interfaces (interfaces = br-lan.10, bind interfaces only), otherwise the share leaks to the WAN side.
• Underestimating the PCIe bottleneck: a Gen4 NVMe rated at 7 GB/s will max out at ~500 MB/s here; do not buy anything beyond a good Gen3.