Question Setting up VLANs on a GS108Tv3 switch to provide internet to tenants

[CreativZero]

I have business internet for my building and my tenants have been asking me for a long time to provide internet to reduce their internet bill. Unfortunately, it's difficult for me to set up. I have installed one cat8 ethernet cable from the service room all the way to each individual apartment (7 apartments). The modem and router for the business internet (fiber) are in the service room. I purchased a GS108Tv3 managed switch and am trying to set it up. I would like to install 7x POE wifi access points, one in each apartment powered by the cat8 cables I already installed. However, I'm having a hard time understanding how to set up the switch.

This is what I have done so far but when I try at home it doesn't work, I just lose internet connection on my desktop PC when I connect to the ports allocated for tenants. Port 1 is incoming from the router and port 2 to 8 are for apartments 1 to 7.

 

[NightHawkRMX]

I am assuming this is an ISP provided router and not something you are able to configure?

 

[bill001g]

Your cat8 cables are likely fakes. Real cat8 cables are almost impossible to get outside data centers and are extremely expensive. Companies that can afford 40gbit or 100gbit equipment seem to have no issue paying $50 for a patch cable either.

You likely just paid too much but it is something to watch out for if you start getting data loss or devices that don't work. This is even more important when you use POE.

So you general plan is ok you are just missing one key thing. You need a router that can run multiple vlans. That is only the first step though it must also be able to run multiple networks. So you would put vlan 1 on 192.168.1x and vlan 2 on 192.168.2.x etc.

If you had asked before you purchased there are layer 3 switches that can do all this function. I am not 100% sure it can do NAT but there likely is a device. I know Microtik makes a lot of inexpensive equipment but I have not looked in a while.

Your best option now is likely to buy a small 2 ethernet NUC type pc. Load one of the public domain firewall/router firmware on it.

You would place device between the ISP router and switch. Key here is want to run what is called a tagged/trunk port betwen the router and port 1 on your switch. This port will carry all the vlans on the same port but it will insert the vlan number into every packet..ie a tag.

You would then on the router setup different networks and then have it translate the networks going to the tenents to whatever IP your ISP router. Many options depending on how many IP address you have.

You have jumped into the deep end on this. Lots of details you have to learn. Gets extremely complex fast.

 

[NightHawkRMX]

Your cat8 cables are likely fakes. Real cat8 cables are almost impossible to get outside data centers and are extremely expensive. Companies that can afford 40gbit or 100gbit equipment seem to have no issue paying $50 for a patch cable either.

You likely just paid too much but it is something to watch out for if you start getting data loss or devices that don't work. This is even more important when you use POE.

So you general plan is ok you are just missing one key thing. You need a router that can run multiple vlans. That is only the first step though it must also be able to run multiple networks. So you would put vlan 1 on 192.168.1x and vlan 2 on 192.168.2.x etc.

If you had asked before you purchased there are layer 3 switches that can do all this function. I am not 100% sure it can do NAT but there likely is a device. I know Microtik makes a lot of inexpensive equipment but I have not looked in a while.

Your best option now is likely to buy a small 2 ethernet NUC type pc. Load one of the public domain firewall/router firmware on it.

You would place device between the ISP router and switch. Key here is want to run what is called a tagged/trunk port betwen the router and port 1 on your switch. This port will carry all the vlans on the same port but it will insert the vlan number into every packet..ie a tag.

You would then on the router setup different networks and then have it translate the networks going to the tenents to whatever IP your ISP router. Many options depending on how many IP address you have.

You have jumped into the deep end on this. Lots of details you have to learn. Gets extremely complex fast.

I agree with this.

If possible I would return that switch, buy a layer 3 switch (has routing built in) and configure the intervlan routing using a switch virtual interface. This is easier and more cost effective most likely than getting a router and configuring sub interfaces, where each interface is a part of one vlan and acts as the router for that vlan.

The search term "router on a stick" may help you if you want to do further research.

 

[CreativZero]

I agree with this.

If possible I would return that switch, buy a layer 3 switch (has routing built in) and configure the intervlan routing using a switch virtual interface. This is easier and more cost effective most likely than getting a router and configuring sub interfaces, where each interface is a part of one vlan and acts as the router for that vlan.

The search term "router on a stick" may help you if you want to do further research.

I bought it on amazon a few days ago so I can still return it. Do you happen to know what would be the cheapest layer 3 switch for my needs? (canada)

 

[CreativZero]

Your cat8 cables are likely fakes. Real cat8 cables are almost impossible to get outside data centers and are extremely expensive. Companies that can afford 40gbit or 100gbit equipment seem to have no issue paying $50 for a patch cable either.

You likely just paid too much but it is something to watch out for if you start getting data loss or devices that don't work. This is even more important when you use POE.

So you general plan is ok you are just missing one key thing. You need a router that can run multiple vlans. That is only the first step though it must also be able to run multiple networks. So you would put vlan 1 on 192.168.1x and vlan 2 on 192.168.2.x etc.

If you had asked before you purchased there are layer 3 switches that can do all this function. I am not 100% sure it can do NAT but there likely is a device. I know Microtik makes a lot of inexpensive equipment but I have not looked in a while.

Your best option now is likely to buy a small 2 ethernet NUC type pc. Load one of the public domain firewall/router firmware on it.

You would place device between the ISP router and switch. Key here is want to run what is called a tagged/trunk port betwen the router and port 1 on your switch. This port will carry all the vlans on the same port but it will insert the vlan number into every packet..ie a tag.

You would then on the router setup different networks and then have it translate the networks going to the tenents to whatever IP your ISP router. Many options depending on how many IP address you have.

You have jumped into the deep end on this. Lots of details you have to learn. Gets extremely complex fast.

I can still return the switch because I bought it a few days ago with the plan to try to make it work or return it if I can't do it. You're right about the router, it's provided by the ISP and I don't think it's possible to do any configuration.

 

[bill001g]

I wish I had a direct recommendation other than commercial stuff like cisco.

Using the switch you have with a small dual port pc running as a router might still be the cheaper option.

You can see if microtik has something. Many of their switches can load switch or router firmware...of course for a added cost.

The main concern I have is about the NAT. This is a common feature in a router and but I am not so sure a switch has it. Most layer3 switches are used as internal router in a large company not as device to access the internet.

This all depends on your design and what your commercial internet account provides. If for example you have multiple public IP addresses you could assign one to each tenant. With a design like it would likely be better to place a router in the apartments and run as a actual ISP where you are just providing the IP and the tenant equipment is doing all the NAT. This design still requires layer 3 switch but is a bit simpler.

The other design would give each tenant a block of IP addresses and then NAT everything to a private IP that your ISP router give you. The ISP router would then nat it again to the public IP. Just a variations of router behind router but with the added separation of the tenant traffic from each other.

In some ways you might want to see if the ISP can provide a actual solution where they sell directly to the tenant using the new cables you ran. Although you likely have a variation of it now if your provide internet the risk you run is if one of your tenants does something bad you can get the internet terminated for the whole location. Without lots of extra effort you have no abiliy to narraow the offending traffic down.

 

[faalin]

If i had to do that setup i would grab,

Ubiquiti Dream Machine Pro
Ubiquiti Standard 16 port with PoE, 8 PoE ports, 8 standard
Ubiquiti U6+ access poiints

This puts all your devices under one controllable device, you will be able to build Vlan's, and control thier download speeds. You dont want one apartment hogging all the internet. This also gives you the capabilities to add cameras to the system down the road as well, the Dream Machine has a built in NVR in it.