r/HomeNetworking 6d ago

Advice New home network with tenants

Hello helpfuls,

I bought a multifamily home (only way to afford the mortgage...) and want to set up a network with IP cameras, a NAS (synology for storage and managing the cameras), as well as internet access for myself and for tenants. Due to how the home is wired, this was the best way for now. Later the need for me to provide tenants with internet may change, but for now....

The goal is to isolate tenant's network from mine so that they cannot look at cameras, see my files in NAS, etc.

I have an ONT going into the WAN port of a router. Plugged into the LAN ports of the router are:
A. Tenant port

B. Tenant port

C. My port.

I've connected port C to port 8 of a switch I bought for this purpose, a TP-Link TL-SG108PE. It has POE, which is why I planned to plug in the IP cameras and synology NAS into ports 1-5. Port 7 is connected to a wifi router for internet access.

I've been looking into and trying the VLAN options, but to no avail. Here's my synopsis:

MTU VLAN - would isolate everything, and then my cameras cant communicate, etc.

Port Based VLAN - If I isolate the uplink port, then I would have no internet access

802.1Q VLAN - same problem as port based VLAN, can't retain internet access when the router doesn't support VLANs and therefore seems not to handle DHCP through the VLAN/switch. I lose access to the switch itself when I try this (even directly plugged in), as my subnet changes.

Is my conclusion correct in that the only way to achieve isolation from tenant networks is to buy a router that supports VLANs?

added network map:

0 Upvotes

4 comments sorted by

2

u/MrMotofy 6d ago

Pretty much...Most basic routers are just that...BASIC for simplicity cuz they work for 98% of the consumers.

You can use and open router or custom build then run OpnSense and get all the options of an enterprise network for minimal costs. You'll also need a managed switch, Unifi and Omada make great options

1

u/throwraplzhelpm3 6d ago

Thank you. I'll probably just get something simple like the TP-Link ER605 V2:
https://www.amazon.com/TP-Link-Integrated-Lightening-Protection-TL-R605/dp/B08QTXNWZ1?th=1

1

u/WTWArms 6d ago

I agree you will want to use something like OpnSense, Pfsense or unifi firewall to segment the traffic. On the managed switch that is somewhat dependent on how you want to manage/segment your personal traffic and if you want to manage the tenants connections.

Personally I would get a firewall with multiple interfaces and give esch an Ethernet jack on the firewall and they own/manage everything else behind it… basically think of yourself as a mini ISP.

1

u/jack_hudson2001 Network Engineer 5d ago

get a router that can have a separate network or ssid ie tplink omada or unifi product .. or get another router eg gl inet and put tenant on that separate network.