The outline you posted makes sense, and is similar to what I'd do if I was the one setting it up: One switch per apartment with its own subnet (192.168.xxx.0/24
, for example), and each of these switches connected to a router that provides DHCP on all of these subnets. The router would then connect to the modem.
An advantage of doing it this way is that the router can also function as bandwidth throttler, so that one apartment can't hog all the available bandwidth, or simply ensuring that the landlord's outlook session is prioritized over the Quatar Camel Race the guy in apartment 3 likes to torrent.
If the router doesn't have enough physical ports, an alternate sollution could be to have a 5th switch connecting the apartment switches, and this "master switch" uses VLAN (802.1Q) to allow the router to work on multiple subnets with only one physical network port connected.
Example 1 - Subnetted
/------Switch1
Modem----Router--|-------Switch2
\------Switch3
Each apartment has its own switch. This requires that the router has enough ports to cater for this, so that no VLANs are required. Each apartment has its own subnet, with the apartment number being the 3rd octet:
Apartment 1: 192.168.1.0/24, Router reachable as gateway on 192.168.1.1
Apartment 2: 192.168.2.0/24 Router reachable as gateway on 192.168.2.1
Apartment 3: 192.168.3.0/24 Router reachable as gateway on 192.168.3.1
By subnetting them this way, each apartment will be separate as per a 24 bit network mask (255.255.255.0) while still allowing the router to serve DHCP to each apartment separately. If desired, you can also set up any firewalling and whatever you want on the router. Note that this is not the same as VLAN, as the separation is achieved only by using IP and Routing fundamentals.
Example 2 - Subnetted with VLAN
If your router doesn't have enough ports, you rely on the ability of your router to have multiple IPs and VLANs on the same physical port.
/------Switch1
Modem----Router--SwitchM--|-------Switch2
\------Switch3
Note the master switch, "SwitchM" between the router and the apartments. This switch has port-based VLAN-tagging, assigning each apartment switch (and therefore anyone connected to those switches) their own VLAN.
Apartment 1: 192.168.1.0/24, VLAN 1, Router as gateway on 192.168.1.1
Apartment 2: 192.168.2.0/24, VLAN 2, Router as gateway on 192.168.2.1
Apartment 3: 192.168.3.0/24, VLAN 3, Router as gateway on 192.168.3.1
Now, the trick is to configure your router with multiple IPs, one for each VLAN. This way, the router will be able to work with each apartment independently despite all of the traffic being funnelled to the same physical port on the router. Note that if you're on a budget, only SwitchM needs to support VLANs. The other switches don't need to know about that aspect, as it is only pertinent to the communications between SwitchM and the router.
Port based VLAN (IEEE 802.1Q) is an extension to the Ethernet standard, and works independently of whatever protocol is used higher up in the model.
Oh, so is what you're suggesting actually this?: modem -> router with VLAN -> 1 switch per apt (in a vlan) -> cat5 jacks and wifi access point? – osdiab – 2015-11-23T17:55:15.583
No need for vlan if your router has enough ports to cater for one to each apartment. If it does you only need to set up a different subnet for each port/apartment. I'll add some details and examples later tonight when I'm not typing on my phone. – Jarmund – 2015-11-23T18:04:47.537
Isn't what you're describing just a port-based vlan? Sorry if I'm misunderstanding... – osdiab – 2015-11-23T18:32:23.837
@OmarDiab No, subnetting and VLANs are two separate things. The apartments should be on separate subnets regardless, but if you lack the interfaces on the router, you can use VLANs to keep them separate while still using only one port on the router. Answer updated with examples and explanations. – Jarmund – 2015-11-23T19:27:38.950
You really should have some form of VLAN separation here. Otherwise, you run the risk of someone in one apartment being able to do bad things to a computer in some other apartment. Not good. – a CVn – 2015-11-23T19:27:55.263
@MichaelKjörling while this is always a good rule of thumb, proper separation of the subnets can be done in the router, as the example without VLANs has the router as the connection point, which can be configured to protect against this. – Jarmund – 2015-11-23T20:35:21.127
It looks like my router, with the right firmware, actually has per-port VLAN functionality—cool! I'll try this out. – osdiab – 2015-11-23T23:04:00.140