My friend running a small business of 100 customer base with services form a isp, having ip range of 172.51.3.2-172.51.3.254, with default gateway of 172.51.3.1, subnet 255.255.255.0, DNS-172.16.0.1. My friend has to assign static ip to all his clients. while accessing web, customers has to sign in a portal of the isp with user name and password and have to keep open the webpage otherwise auto logout will happen after 45 minutes. This login server located somewhere else recognizes ip of the each client and allows log in from specific ip only.
Now he is adding another service provider with two IP subnet, 172.16.5.1 & 172.16.6.1, these two IP subnet is coming through a same wire. this ISP also implementing such portal to log in. now he is just putting all these in a switch, as a result all of this his customers facing a lot of problems. any one of them haveng ip range of any network can access the whole system, cpes having same ip, say 192.168.1.1 conflicting with each other.
now he wants to separate these three subnets customer with a rb750 that no one from a subnet sees clients from other subnet , how it is possible.
I have some opinion for your questions.
with /24 or 255.255.255.0 sub mask, only same prefix can talk with each other, so what it’s means you don’t need firewall or something like that any more if you don’t want they communicated with each others.
if you want they can speak with each other you need to put appropriate route rules.
assuming all of your networks can access dns server via given ip by your isp and you only get private ip from your ISP.
for the first networks 172.51.3.1/24 eth 1, client for range ip 172.51.3.2-172.51.3.254 in eth 2, you only need to set eth 1 as master port for eth 2, you can do this in interface then you can put ip address for ether 1 in ip —>address.
that the easy step now for ether 3 for ip 172.16.5.1/24 & 172.16.6.1/24
you can choose this 2 method, which one is more easier for you.
option 1
put the ether 4 and 5 as slave of port 3 and make vlan for each of eth 4 and 5 then put the each ip in each vlan in ip->address, don’t forget to add which interface for which networks.
option 2
as the same as above put ether 4 and 5 as slave of port 3, but here the different, you don’t need to make any vlan, you directly put the ip that your isp gave you in ether 4 and 5.
if you ask me I will choose option 1 since I think it more secure and reliable than option 2.
so basically you make your router as layer 3 switch and let all the routing became the your ISP problems.
BTW if your ISP allowing you to have your own dhcp server, you can make dhcp server after finish all step from above, you can make dhcp server for all your networks, in your RB, if you use the winbox choose IP — DCHP server and choose dhcp setup, it’s the easiest way to make dhcp server than manual, it even put ip range automatically which ether or vlan handle which ip range as long as you put the sub mask when you set ip in ip address in mikrotik, in your case is /24 or 255.255.255.0
with that you don’t need to set ip manually in all of client and less risk of ip conflict for extra measurement you can even stick their mac address for which ip vice versa you can set how long those ip needed to be renew which really handy if you have “short visitor” like in hot spot environment.
I hope this will help you.
thank you for your reply, But it took 6 days to appear after you post the reply.
I will try your sugestion, meanwhile my friend has purchased a new L3 switch, First of all i will try with your method then play with the new one.