Learn the steps to configure your network correctly.
Learn the steps to configure your network correctly.
Hello! In this scenario, you're managing flats within the same building where each has its own subnets. The basements contain shared servers, and you're using an ISP that supports dual stack. You plan to use an Ubiquiti Dream Machine Pro as a layer 3 switch, with two USW-Pro-24 switches acting as layer 3 switches. The modem is NAT-less so the router receives its public IP through the WAN port. Your main concern is isolating the two flat networks while still sharing servers and internet access. Since you lack subnetting or VLAN experience, focus on setting up proper routing rules to keep the networks separate yet connected. Review the diagram below for clarity. What advice would you give for basic routing configurations? Thank you!
I mentioned it to simplify things, but in truth these addresses use different subnets such as 192.168.0.0/24 and 192.168.1.0/24. Thanks for bringing that up, though it isn't the main issue...
In April 2012, IANA assigned the range 100.64.0.0/10 (from 100.64.0.0 to 100.127.255.255 with a netmask of 255.192.0.0) for carrier-grade NAT situations. This segment isn't suitable for private networks or public Internet use. This information might assist the OP referenced in the provided link.
The IPv4 Internet doesn't rely on these addresses. Yes, but no. Your issue lies in translating your project to reality. The sample you provided isn't practical because the subnets for Flat 1 and Flat 2 aren't compatible. "It's not the same" is enough—it still works—but eventually it breaks down. Things like connecting to Microsoft or government servers won't function properly. For switches, all VLANs must be recognized; otherwise, traffic can't pass. On SFP ports, every VLAN needs proper tagging. At Flat 1, only Flat 1 VLAN should remain untagged on other ports, while Flat 2 must be blocked. Similarly, at Flat 2, only its VLAN should stay untagged, and others should be blocked. Then apply firewall rules between subnets. Subnetting is key—no exceptions. No one should access switch management or servers from either flat. This requires expert help whenever needed. It's all volunteer effort. Being selective can seem rude sometimes.
I'm imagining a shared setup within two family homes, not splitting flats for third parties. For clarity, I'd place the ISP network inside the server room, routing through your router/firewall to three separate subnets: servers, flat1, and flat2. Flat1 and flat2 should connect to the servers without direct communication, using dedicated IPs only for their intended services. If you need to allow access from flat1 to the servers, set up firewall rules carefully. However, heavy traffic like network shares can stress the firewall, so I favor keeping everything within a single VLAN for simplicity. I'm careful about details—just make sure the numbers match what you're asking.