Suppose one wishes to provide guests with access to the Internet (and only the Internet) over one's network. For obvious reasons, switch ports will be assigned to a private VLAN created specifically for that purpose.
It strikes me that one can either place the hosts in a shared subnet (isolating between them at L2 only); or else place each of them in their own subnet (thereby also isolating at L3)—this latter case effectively creates point-to-point links between each guest host and the gateway, which seems more rational to me because it more accurately reflects the logical design.
However such point-to-point links would traditionally require a subnet with at least a /30 prefix (in order to address both the guest and the gateway as well as provide network and broadcast addresses for the subnet itself); applying RFC 3021, one could use /31 prefixes—but this would still require a virtual interface on the router for each guest and consume 2 addresses per guest host: not a particularly efficient use of resources.
So it has struck me that one solution could be to use PPPoE between the guest host and the router…
Is this sensible? Have I overlooked any pitfalls, or more appropriate solutions?
Can DHCP configure a client expecting IPoE to use IPoPPPoE instead, or must the guest host OS be prepared for PPPoE? If the latter, do popular workstation OSes (Windows/Linux/OSX) attempt PPPoE Discovery if DHCP fails?
If the router is also performing IP-masquerading (i.e. many-to-one NAT) it strikes me that every PPPoE host could in fact be assigned the router's egress address: the NAT need merely map upstream ports to PPP interfaces (rather than IP addresses); this would provide the "advantage" that the hosts would then be configured with their actually visible external address. Seems pretty ridiculous to me, but is it nevertheless possible?