I’m in desperate need of some unbiased advice and suggestions. Everyone I ask seems to want to sell me a £2-5,000 firewall appliance and £1500+ per year of support/licencing.

I have a 1gb leased fibre internet connection terminated in a Openreach 21cn unit and a block of 15 public fixed ip addresses. I want to carve up that 1gb bandwidth into 10mb-1gb chunks for individual tenants in a multi business occupied building.

Each tenant is connected to landlord room with SM fibre is responsible for their internal LAN equipment (which I will have no control over), I just need to provide them with either a sfp module or a RJ45 copper connection via a media convertor.

I think I need a 1gb firewall appliance with 1gb throughput with either one RJ45 or SFP WAN port and 6 LAN ports (6 is enough for now) I have struggled to find appliances that have this sort of number of SFP LAN ports, best I have found is 4 so would have to use media convertors for the other 2 (not ideal).

Looked as old version used (affordable) products designed for big enterprise users such as SonicWall NSA7500/3600 kit which would do this for a sensible price

Considered pc based products such as pfsense using a spare quick PC and buying multiple port or several single port sfp NIC cards but sfp NIC cards still haven’t come down in price much.

Because I don’t want there to be any chance of any LAN talking to another LAN and I want zero visibility of the LAN’s between each other and each LAN would have its own public IP, I thought the above way was the way to go.

I could then assign a fixed public IP to each firewall LAN port and have some control over bandwidth hopefully ?

If I could have control over the tenants own router then I guess I could just have a one LAN port firewall running transparently and feed that into a basic SFP switch and set up each tenant router with its fixed public IP ? but I don’t really want to be responsible for kit in their rooms as well as my own.

Above all I need a reliable affordable solution which won’t break the bank, be easy to maintain and leave all tenant networks to be secure. Any ideas ? ! Any help appreciated.

Edit: Not looking for a specific product recomendation, more a way of achieving a soloution, be it switch, appliance, multiple appliance or pc based.

  • Unfortunately, product or resource recommendations are explicitly off-topic for SE sites, except Software Recommendations and Hardware Recommendations. Also, questions seeking primarily opinion-based answers (the best, the cheapest, etc.) are off-topic here, and residential networking is explicitly off-topic here. – Ron Maupin Oct 13 '18 at 12:49

The simplest way is to route each public IP for a tenant centrally and use a switch for the links. Using ACLs, you could restrict each switch port to using its dedicated public IP address only (and prevent them from interfering with each other).

Tenants could communicate using public IP addresses only and things like NAT and firewalls would be up to them.

Since you'd not be requiring NAT this way you could use a single layer-3 switch for the entire distribution. The switch should support bandwidth control as well.

Not the answer you're looking for? Browse other questions tagged or ask your own question.