Help for VLAN setup on OS X based small office - IP cams, VoIP, Wifi guests and more

Generally (though not necessarily) separate VLAN's are given separate IP address spaces. So for example you might take 10.10.1.0/24 and make it for video, 10.10.2.0/24 and make it for workstations, 10.10.2.0/24 and make it for phones, etc. This not only provides layer 2 isolation, but also isolation for layer 3 managed by either a layer 3 switch(s) or a router(s)/Firewall that will pass traffic between them. This allows you to have relatively simple IP filtering rules between VLAN's. For example, you might disallow entirely anyone with IP's on your guest network from communicating with devices on an internal network. You can also then limit types of traffic, for example permitting port 80 traffic to one specific device for guests, but not others (and more active, stateful firewalls can do all sorts of additional filtering and inspection).

(I should note here that one of the complexities comes from NAT, since you will likely have a different address space internally than externally, allowing guests access to internal resources, say a web server that is NAT'd to the same name externally, can be a challenge).

While there are many, many choices, the simplest starting point is probably to assume all devices are in one and only one VLAN (except managed switches and routers, and maybe except phones which often pass a voice VLAN separately from a data VLAN if they have a data port). Then lay them out and figure out what the rules are for traffic passing from and to each of those areas, and from each area to the internet (and from each to other sites if you have other sites). This form of... perhaps deconstruction is the word.. let's you lay out your virtual topology, and make isolated decisions of the flow of traffic between, i.e. rather than just asking "who can talk to whom" you can say "can guests talk to video" and turn it into a series of very specific decisions. That then translates relatively nicely into how each port is set up - which vlan it is allowed to access, and which carry the trunks (i.e. multiple vlans to pass from one switch to another).

The idea of having unmanaged switches actually can complicate this sort of setup, unless you dedicate each switch to one and only one VLAN. Which in turn can cause issues if you have devices like cisco phones which have a separate PC connection data port, as this requires passing both the phone and data VLAN's in one port. While it is perfectly possible to pass two different VLAN's traffic through an unaware, unmanaged switch, it just begs for bad things to happen (e.g. spanning tree turning off a port thinking it is a loop, when it from your perspective is a different vlan).

So to your question, the sinology NAS could be given an IP on the internal network, and any devices on any network could communicate with it through your layer three routing device (subject to your rules). There are other choices, that let it live on more than one vlan at a time, but they (in my opinion) add more complexity than they solve. Keep it simple, put everything in their "normal" place, decide on the flow of traffic between these places, and if you have a few exceptions left over (after asking are they in the right place), then write specific rules for individual devices (as opposed to whole VLAN's).