Multi-Tennant setup

RouterOS Beginner Basics
1

I am in the process of ordering a CRS125-24G switch for an upcoming event that my company is in charge of providing network infrastructure for. At this event, there will be multiple clients that will provide their own firewalls, and we will assign them individual IPs. So the setup we plan to have is something along these lines:
ISP Gateway > ethernet handoff >> CRS125 switch >> multiple tenants.

The logical configuration will be :
ether1 > ISP/WAN
ether2-24> non-brdge ports

The clients do not want their data crossing paths. Each client will have a router which they will be assigned a public IP.

What’s the best way to set this up to keep client data separated while still using the same /28 address space?

2

How many separate entities will be getting service through you? If it is 12 (1 for ISP + 1 for your router + 12) or fewer you can simply assign all ports to be slave to your WAN interface and their router will get a public IP that way. You can use FW rules on your Mikrotik to prevent the IPs from cross-talking.

If you are going to provide service to more than that, are they going to be running NAT on their device? Will Double NAT be a problem for anyone? Are you going to be providing DHCP leases to all of your customers or will they for all of their devices?

3

Looks you would need more a router than a switch. Please describe intended design in derails with performance expectations.

4

Each client will provide, or be provided, a router to connect back to the gateway IP for internet access. Each router will provide local DHCP.

The FW rules to prevent cross-talk is intriguing. Which rules would you implement to prevent cross-talk?

5

FW rules would be simple.

For instance, let’s assume your public IPs were: 192.168.1.0/28

1 create statement permitting 192.168.1.0/28 to “talk” to ISP IP (192.168.1.1) and your Router’s WAN IP (192.168.1.2). (this will help in troubleshooting connectivity issues)
2 create statement denying traffic to “talk” within the /28. deny 192.168.1.3-192.168.1.14 to 192.168.1.0/28 (this is assuming there is no layer 2 connectivity between them, such as a switch before it reaches your FW)

Obviously I have not provided the correct syntax. This should get you started.