Well after some thinking... You're missing one Router to accomplish what you try to do. You have that Verizon Router. Let' say you set the LAN to 192.168.0.0/24 now you would need another Router, let's say you get the Meraki Go GX50. You connect the GX50 to the Verizon Router and give it a Static IP on the Verizon let it be 198.168.0.100. The GX50 is set to have dynamic IP-adress for Internet connection. Connect your GR10's to the GX50 and create the VLAN's you want to have, let's call them Default, ID 1 (IP 192.168.10.0/24) Church_Stuff, ID 2 (IP 198.168.20.0/24) and Church_Guest, ID 3 (IP 192.168.30.0/24). Connect your NAS to VLAN 1 and make the IP static let's make it 192.168.10.250. VLAN 2 gets a SSID "Stuff" and has to be set to Bridge-Mode. VLAN 3 gets a SSID "Guests" and needs to be set to NAT-Mode. Now everyone on VLAN 1 wired and VLAN 2 wireless can access the NAS and the resources placed on VLAN 1. VLAN 3 is blocked and only has Internet-Access. Now you would need to set some portforwarding rules on the GX50. Allow Port 445 for 192.168.10.250 and set the allowed IP-Range to 192.168.0.2 - 192.168.0.254. This will allow SMB access for a device directly plugged in the Verizon Router on the Network 192.168.0.0/24 but not from the Internet. To access the NAS from that Network thru SMB you have to use the Wan-IP given to the GX50 (192.168.0.100) The GX50 will translate that to 192.168.10.250. Now if you want acceess from abroad. I would recomment to use a VPN-Server and not use the ftp-protocoll. You can setup the VPN-Server on the GX50 and use that one to access the resources on the LAN. All you have to do is forward the VPN-Ports on the Verizon Router to the GX50 (192.168.0.100). If you want the ftp to work you'll have to set rules on the Verizon Router and the GX50. On the Verizon the Ports have to direct to the GX50 and on the GX50 the target is the NAS. You can't set a rule to allow IP-Adresses like you did on the SMB-configuration. Since 192.168.0.1 will be the only IP visible for the GX50. So please don't go ftp, use VPN!!! If you need wireless access to the Verizon Router. Maybe that one has a build in wireless you can use. This setup should give you exactly what you were asking for. Guests only be able to reach the Internet, wired has it's own VLAN (Default) with access to all resources, have a wirless VLAN for stuff with access to resources. the only thing that might be missing is wireless access to the NAS from one client but I guess you get an idea what you're missing to accomplish that too. Hope this helps.
... View more
