Share an internet connection within three separate subnetworks/VLANs

Question

I want to share a FO/Internet connection among three separate small offices.

Internet provider modem/router has LAN 192.168.1.0/24, with its gateway at 192.168.1.1 and serving IPs (192.168.1.100-200) via DHCP to all its LAN PORTS.

|CPE INTERNET PROVIDER|----- 192.168.1.1

I would like to serve the following separate subnetworks:

NETWORK 2 ETH ----- 192.168.2.0/24 (DHCP RANGE 192.168.2.100-192.168.2.200)

NETWORK 3 ETH ----- 192.168.3.0/24 (DHCP RANGE 192.168.3.100-192.168.3.200)

NETWORK 4 ETH ----- 192.168.4.0/24 (DHCP RANGE 192.168.4.100-192.168.4.200)

I am thinking in the following setup, with either a Ubiquity EdgeRouter or a SMB Cisco:

 __________________________________________
|         CPE INTERNET PROVIDER            |
|               192.168.1.1                |
|                   /16                    |    
|__________________________________________|
                     .
                     .
                     .
 __________________________________________
|               192.168.1.2                |
|                   /16                    |
|                WAN PORT1                 |
|                                          |
|               CISCO OR UBIQUITI          |
|                                          |
| LAN PORT2      LAN PORT3     LAN PORT4   |
| 192.168.2.1    192.168.3.1   192.168.4.1 |
|     /24            /24           /24     |
|   (VLAN2)        (VLAN3)       (VLAN4)   |
|__________________________________________|
     .               .              .
     .               .              .
     .               .              .
     .               .              .
SUBNETWORK2     SUBNETWORK3    SUBNETWORK4

1. configuring the Internet CPE modem/router LAN to 192.168.1.0/16.
2. disable DHCP in that CPE.

3. attach a Cisco SMB RV325 or a Ubiquiti EdgeRouter, with:

   a) its WAN interface configured to 192.168.1.2/16
   b) VLAN2 configured in LAN Port 2 with network 192.168.2.0/24
   c) VLAN3 configured in LAN Port 3 with network 192.168.3.0/24
   d) VLAN4 configured in LAN Port 4 with network 192.168.4.0/24
   e) DHCP Pool configured in LAN Port 2 with IP Range 192.168.2.100-192.168.2.200
   f) DHCP Pool configured in LAN Port 3 with IP Range 192.168.3.100-192.168.3.200
   g) DHCP Pool configured in LAN Port 4 with IP Range 192.168.4.100-192.168.4.200

LAN ETH ports 2,3,4 would serve via ethernet cables the small offices, where a regular switch at the ends would allow connect all devices.

My doubts are:

1. does this setup make sense?
2. Do CISCO SMB RV325 or Ubiquiti EdgePro allow to configure separate DHCP pools per VLAN/PORT?
3. How do I ensure that VLANs/subnetworks are not reachable between them?

Thanks,

Answer 1

1 - the setup make sense, but there's one potential issue: The ISP provided CPE may not NAT networks others than 192.168.1.0/24 to the Public IP address. I.E. it will not perform NAT for the 3 subnetworks. If this is the case, you may have to NAT those 3 networks with IP from the 192.168.1.0/24 network.

(btw there's a discrepancy between the text Internet provider modem/router has LAN 192.168.1.0/24 and the schema where it is noted as /16, I assume the correct one is /24 as it is the most common case)

2 - For DHCP

• Cisco SMB RV325
  It is not clear from this user manual that you can configure separate DHCP pools, but there's 90% chance it is the case.

  In the CLI reference guide it is not explicit either but the syntax use seems to imply it is possible.

interface vlan modify 25 dhcp 192.168.22.2~192.168.22.150 dns static 11.11.11.11 11.11.11.22 wins 33.33.33.33 option66 tftp.server.org option150 44.44.44.4 option67 file.txt

In the worst case, it supports DHCP relay so you can relay DHCP requests from all VLAN to an external DHCP server

• Ubiquity Edge pro
  I'm not familiar with EdgeOs but it's based on Vyatta, which I used a lot, and it is possible without a doubt.

3 - To ensure that VLAN can not communicate together, you have to configure ACL (Cisco) or Firewall Rules (Ubiquity).

The SMB RV325 support 50 ACL rules, while the Ubiquity should not have limitation (other than memory) and you can either use interface based firewall or zone based firewall.

Answer 2

does this setup make sense?

I see no problem with the basic premise, as long as you meant 192.168.1.0/24 and not 192.168.1.0/16 for the "middle" network (unless you are planning to utilize proxy ARP - bad idea). Also assuming you are planning on performing NAT on the Cisco/EdgeRouter (or else you will need either dynamic routing such as OSPF or static routes on the CPE device).

A few suggestions, with the setup you describe you could configure a second EdgeRouter to provide redundancy (not sure if the Cisco platform is capable of this). With both devices connected to the CPE device, you would simply need to run VRRP on the internal LAN interfaces. This is more complex, but you can take a failure of one device without any of the offices being adversely affected.

If you don't go with a redundant setup (or if you have multiple WAN IP addresses from your provider) and if the CPE device can be configured to do so, then you could operate it in a bridge/bypass mode so the Cisco/EdgeRouer handles all the outside traffic directly. Eliminates a L3 network that isn't needed, avoids a double NAT situation on your side and gives you more control overall on your gateway device.

Finally, if you have the interface available, set up a fourth LAN network that you can plug into directly if needed, especially if you are not one of the three office tenants. That way you won't have to connect to one of the office networks (which they may object to) anytime you need to do maintenance.

Do CISCO SMB RV325 or Ubiquiti EdgePro allow to configure separate DHCP pools per VLAN/PORT?

Yes, I believe they both do; although I have never used that particular Cisco product, that is a relatively basic feature for this level of device.

Note: the Cisco RV325 is End of Sale as I type this. You should instead be looking at the RV345 which is the replacement for the RV325.

How do I ensure that VLANs/subnetworks are not reachable between them?

Specifics depend on chosen vendor/product, but the basic premise would be through the use of ACLs and/or firewall features. While there may also be means of simply not routing any traffic from one VLAN to another on the Cisco/EdgeRouter, depending on how the CPE device plays in the mix it may allow traffic to get "redirected" back into a different VLAN.