Router recommendations for network partitioning (and dual-WAN)?

[ddrueding]

Helping a friend put together some numbers on building out a co-working space. One of the challenges is making a network where all the wired ports have access to the internet and shared resources, but not each other. I also plan on having two internet connections for reliability and speed.

With potentially 16 partitioned wired network spaces, will I need a router with that many ports? Something like the Mikrotik Routerboard stuff? The CRS125-24G-1S-2HnD-IN looks promising?

Thanks!

 

[Chewy509]

With potentially 16 partitioned wired network spaces, will I need a router with that many ports?

Not going to discuss actuals products, but...

You don't need a router with a large number ports if you use a decent L2/L3 switch between the gateway router and their internal gateway devices...

eg, the building has an IP range of 9.1.1.100/27. For example each business is on a separate floor and each floor has it's own dedicate global addressable IP from the 9.1.1.100/28 pool. You simply need a switch between the building router and each floor (each floor gets its own port on the switch).

Why does this work... well the switch (either via VLAN or ARP) will only forward frames to the correct floor based on IP... And to the building router, it only cares about that on one side if 9.1.1.100/27 and the other is the rest of the world...

So:

10.0.0.0/8 -> NAT device (internal gateway of business 1) 9.1.1.103 -> switch
10.0.0.0/8 -> NAT device (internal gateway of business 2) 9.1.1.104 -> switch -> building router (9.1.1.101) -> The world...
10.0.0.0/8 -> NAT device (internal gateway of business 3) 9.1.1.105 -> switch

Note that this is simply one way of doing it, as you mentioned you could get a 16 port router and each internal gateway device connects directly to one of it's ports... The only time that this would be required is that each internal gateway device has a globally routable IP address that is not with a common small subnet address range (like in my example). But if the plan is to sub-let, and you're providing ISP service, then they get the IP address you assign them...

The other way, is just to NAT them behind the building router, and they need to get permission to have inbound ports open... but this is messy for obvious reasons.

 

[ddrueding]

Thanks Chewy. I think the scale of the implementation is smaller than you realize. Most of these "tenants" are single machines. The port (or Wifi) connection they get from me needs to already hand out DHCP for a plug'n'play experience. My understanding is that your suggestion would work from a routing standpoint, but wouldn't manage DHCP/NAT. And I do want the users NATed with no inbound ports open. Think of this as one step above a coffee shop wifi. There will be shared network resources; at least a MFC, possibly NAS stuff, but I don't want the various networks to route to each other.

My thoughts were to set up most of the ports on the router with their own DHCP server handing out a unique /28 and routing rules to the internet and the shared LAN (in a master /24?) without allowing access to the other private networks?

 

[Chewy509]

The way you've described it, I don't know of any off the shelf routers that will do all that. A server that's built with 16ports and Wifi can certainly do it, with the correct DHCP and firewall service setup, but don't know of an off-the-shelf solution.

 

[ddrueding]

I'm pretty sure the MikroTik with the stock WebFig software will do it. I'm running their top-end 1100 AH X2 at home, and it will let me add a unique DHCP server on every port if I like. The thing is crazy powerful and flexible. The downside is that it took me 2 hours to configure the thing to even replicate a default Linksys router config, but it seems to be able to do just about anything.

 

[P5-133XL]

Including doing the same on a wireless signal? You did say wireless didn't you. Wouldn't that require matching multiple mac address's to multiple different lans and their DHCP servers. On a wireless signal, how do you distinguish a specific wireless machine without needing to manually assign the MAC to a specific lan and it's DHCP server. Isn't that the equivalent of management hell.

 

[ddrueding]

Including doing the same on a wireless signal? You did say wireless didn't you. Wouldn't that require matching multiple mac address's to multiple different lans and their DHCP servers. On a wireless signal, how do you distinguish a specific wireless machine without needing to manually assign the MAC to a specific lan and it's DHCP server. Isn't that the equivalent of management hell.

A bunch of wireless routers offer "Isolate WLAN" as a switch out of the box. Wireless clients can see the internet and each other but nothing else. This isn't ideal, but trying for better with wireless is like putting a really good lock on a glass door.

http://smallbusiness.chron.com/isolate-wlan-lan-61740.html

 

[P5-133XL]

But 16 wireless routers all running in the same spot will interfere with each other's signals dragging the data rates down significantly.

 

[ddrueding]

But 16 wireless routers all running in the same spot will interfere with each other's signals dragging the data rates down significantly.

I don't plan on running 16 wireless routers, they can all play in the same wireless box.

 

[Howell]

Vlaning w/ ACLs and vlan capable APs are the way to go. Cover the area with the appropriate number of APs so you don't get spectrum conflict and assign an SSID per vlan. Then a separate device can handle the dual wan.

 

[ddrueding]

Vlaning w/ ACLs and vlan capable APs are the way to go. Cover the area with the appropriate number of APs so you don't get spectrum conflict and assign an SSID per vlan. Then a separate device can handle the dual wan.

Interesting idea. I suppose even on the wired side I could just use vlans to keep things separate; single DHCP server handing out into all the vlans, shared resources a member of all the vlans. Once again we are back to a smart switch and a more basic router.