To follow up on what @KatherineVillyard said, if you need to access your NAS or other systems from the campus in general, here's what I'd do:
Talk to whoever manages the campus router, and ask them to reserve you a block of 256 IP addresses, which I'll call A.B.C.0/24. The values of A, B, and C are specific to your campus. If you can't get 256 addresses, you'll live, but get at least 16. Smaller reserved blocks will change the 0 and the /24 to different numbers, up to /28 if you only get 16 IPs allocated.
They'll also need to configure various campus routers to route your reserved block through a specific IP address in a different network block (like the one that already reaches to your room).
If you can't get a block of addresses reserved, you'll have a harder time making your NAS accessible from the rest of campus, but everything else should work ok from inside the network to the outside world. It's certainly not impossible, but it might not be worth the extra effort. Try as hard as you can to get the block of addresses -- you might need to talk to a few different people if the first one doesn't understand what you need.
If you got a block of reserved addresses, you need to record the block's network address and netmask, and also the outside IP the block will be routed through. If you didn't get a block of reserved addresses, you're probably going to end up using a home router/firewall, and you can just use whatever settings it has by default.
If campus IT is really easy to work with, you can also ask for a delegated DNS subdomain for your lab, too. Something like gavinslab.campus.edu. It's really not critical if they don't give this to you, but it's convenient.
If you got campus IT to reserve you a block of addresses, find an old PC you can put three network interfaces in. It doesn't have to be powerful at all. I've routed 100 Mbit traffic over an original Pentium, and gigabit over a Pentium III. I've really not tested the lower limits, just worked with whatever was easily available.
If campus IT couldn't allocate you a block of addresses, just get a home router/firewall instead.
Then, grab gigabit ethernet switches from somewhere. A home office switch should be plenty, as long as it has enough ports. If you got IT to allocate a block of addresses, get two switches. Label one switch "DMZ", and the other one "Internal". If they didn't allocate you a block of addresses, only get one switch.
Routing/Firewalling (assuming no allocated network block)
If you didn't get a block of addresses, just hook up the home router with the external network interface plugged into the campus, and one internal network interface plugged into your gigabit switch. Treat the room like a home network, where you can get to the campus and outside world without problems, but the campus and outside world will have a hard time getting back to you.
Routing/Firewalling (with an allocated network block)
If you did get a block of addresses, then hook up the onboard network interface of the old PC to the campus network. I'd normally install Debian on it.
Afterwards, I'd install the second and third network cards, and then use my firewall-bootstrap tarball to configure firewalling, DNS, DHCP, and other critical services (we've beaten the crap out of that script in a class I'm running labs for, but wider testing and feedback is welcome). If you have the experience, feel free to do something else equivalent.
Everything else (with an allocated network block)
Plug one powered-up switch into one of the additional network interfaces in the firewall. Check kernel messages to see which ethernet interface just came up. If you're using my script, you want to make sure the Internal switch is on eth1, and the DMZ switch is on eth2.
Plug systems that need to be directly accessible from outside the room onto the DMZ switch. Plug all other systems into the Internal switch.
And from there, honestly, you're going to need to ask more questions as needed. I trust my script to set up a working DNS and DHCP setup for both network segments, and to block outside connections by default. But everything else tends to be site-specific.