0

Today i got put on a project to solve a networking project for a friend who rents out multiple office suites. Internet is provided to all suites in the rent cost. The guy who originally set everything took a single fiber connection and put it into a BSD server.

So essentially what is happening is that the BSD server acts as a NAT & Firewall to all of the office suites. It has a single static private IP assigned to each suite, the tenants then use a standard router to serve all of their machines.

This works, but it's a double NAT and some tenants have issues with some services because of it.

I want to reduce it to a single NAT system and have each suite on its own subnet of IP's that they use directly (no additional router). The problem is that if anyone got smart they could simply change IP's and invade into another suite's network.

The primary issue is that i cannot have a DHCP server, as it will serve the whole complex not just one subnet. I need to have a DHCP server (or a single server that can serve multiple subsets) on each subnet.

What is the best way to achieve what i need? I am going to assume that VLAN's are the way to go, but i don't know much about them. Although i have always wanted to learn how to build a VLAN. I know i will need a managed switch, but i don't know if VLAN's are segregated on layer 2 or layer 3.

Improve this question
3
  • 1
    You have two basic choices. You can use VLANs or you can use physically separate networks. How many suites? Is 100Mbps to each suite sufficient? (100Mbps managed switches are dirty cheap. Heck, I threw a high end one away last week.) Also, if you don't support UPnP or the like, people won't be too happy with single NAT either -- same issues.
    – David Schwartz
    Dec 16, 2013 at 3:53
  • I would tend to choose the VLAN option, because all of the suites are already wired together as a single network. There are a total of 20 suites. I was actually looking at some Cisco Catalyst 3500 series switches. 100Mbps should be fine considering the users will have their own gigabit switches for their internal traffic.
    – TriadicTech
    Dec 16, 2013 at 4:07
  • In addition a single dhcp server is capable of serving multiple subnets. One needs to have a mechanism for forwarding dhcp broadcasts to the dhcp server. This is commonly done either through letting the router(s) between the client and server pass the dhcp traffic (ip helper in Cisco), or by placing a dhcp relay agent on each subnet (which talks broadcast with the client but unicast with the server).
    – ErikE
    Dec 16, 2013 at 6:49

1 Answer 1

Reset to default
2

I ended up picking up a few Cisco Catalyst 3500 XL's on the cheap and giving each suite it's own VLAN. Then i made a trunk port with 802.1q encapsulation and fed it to a BSD server with NIC's that could decode 802.1q.

It works like a charm, each vlan get's its own subnet and the firewall rules prevent inter-vlan routing to keep everyone segregated.

I'm going to keep a close eye on traffic to make that 100mbps is enough at the server end, i may have to pick a 3550 and do link aggregation.

Thanks for the help!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .