Router Recommendations

[uk26]

Background
We have a 100mb leased line wires only. currently using a Draytek Router which is ok for the usage.

However, we are taking over the building and one of the key tasks is to provide 50 serviced offices with Internet.

We want to split each office into their own private network to protect from other offices etc.

the router must also support more than 3 public IP subnets.

via the draytek we have 3 public lan subnets so public IPs can be put on servers etc and we currently have 32 Public IPs split into smaller blocks and put on the correct lans.

any suggestions?

 

[KM-Tiger]

You probably want a custom build.

We've done this, splitting the offices into separate vLANs, then firewalling to ensure that interconnection between offices is not possible.

Rate limiting is also possible to ensure one office cannot hog the bandwidth.

Doable, but non-trivial.

 

[leemason]

I'd agree with that. A VLAN per tenant would be best. Which Draytek do you have? This would be a function of the router plus some decent managed network switches. Rate limiting as suggested by KM-Tiger would also be good.

 

[FlexibleTelecom]

HI,

We run our own wireless ISP on a business park in Warwickshire. We did not use Vlans and firewalls due to the system resources needed and the 2k+ Cisco price tag.

I take it that the building is split into loads of smaller office units with multi-tenants in each.

We have installed pfsense with a PPPoE server and then each client has an Ethernet wireless router that they connect with. We have a range of cheap TP-link £20 routers to draytek 2830’s running.

Using PPPoE means each client is separate, but still protected. The main benefits for you are core network changes are much easier as they are controlled from the one server, If you want to change a tenant to a public ip you simply change it in pfsense, kill the active sessions and when the client router reconnects the new settings are applied. Each tenant can then manage their own port forwarding if you want.

Then you just need good quality unmanaged switches and bridge everything between each client.

Pfsense is free and supports 1:1 NAT and multiply wan and lan interfaces. You can set bandwidth management as well.

If you have a “Hot Desk” area you can use the captive portal to sell Wi-Fi time or add there mac address then allow the device to connect over the lan or wireless.

Best regards
Martin

 

[leemason]

Martin: I never thought of using Pfsense in that way but it sounds a really good way of doing it. Also Pfsense being Open Source is well supported with new developments and handles voice traffic very well also. Great idea, thanks!

 

[uk26]

the only issue doing PPPoE non of the other tenants have their own router the previous I.T Company setup it up as one big network with no firewall anywhere

We have ripped out the 8 PSTN lines and with bonded DSL and installed fiber leased line connected to a Draytek 3900. Replaced the network switches with 20 x Draytek Vigor Switch G1240 which supports both port and tagged based vlans.

32 Public IP Addresses which sit on the lan side of the Draytek 3900

currently split into 4 smaller subnets

2 x XXX.XXX.XXX.XXX/30 (2 Usable Public IPs per block)
General Internet Access to building

1 x XXX.XXX.XXX.XXX/29 (6 Usable Public IPs per block) Site Mail and Telephone Servers etc

1 x XXX.XXX.XXX.XXX/28 (14 Usable Public IPs per block)
Reserved for customers who request public routed ips

I have secured the router's firewall down to only allow incoming ip traffic for defined ports etc

 

[leemason]

The 3900 is a pretty capable firewall so that should give you a decent level of control. It does support some bandwidth management and VLANs so you should be able to segment out different users traffic on that.