Share Internet to rental apartment

[KristianHN]

Hi all

Just bought a house. As part of the house there is a separate apartment that I will rent out. I will have to provide Internet to this apartment. I have come up with what I think will be the final network design, but I need some input to what device I should put in after the Cable Modem (see image “What to put here?”) in order to split the two networks. The networks need to be totally separated. And it would be nice if I could control the bandwidth to the apartment.

Please also comment if you have any ideas for improvements.

Thank you.

 

[degrub]

You really don't want anything your renters do tacked to your ip address supplied by your isp. Just advise them they are responsible for their own isp contract and have your isp run a drop to a demarcation point for the apt. Or let the first renters order it.

 

[KristianHN]

You really don't want anything your renters do tacked to your ip address supplied by your isp. Just advise them they are responsible for their own isp contract and have your isp run a drop to a demarcation point for the apt. Or let the first renters order it.

This is unfortunately not an option. The apartment does not have its own phone line or cable line for the cable modem.

 

[degrub]

If you are in the US, unless it is physically impossible (out of pairs, too far, etc.), it should not be an issue. They will want a contract so that is why i suggested leaving it up to the renter.
If you have a landline, there is likely an extra pair going to the main house that could be used. If you have cable to the house, they will just split ahead of you and run the drop.
Have the cable and phone ISPs told you it is impossible to do ?

 

[sfx2000]

Just bought a house. As part of the house there is a separate apartment that I will rent out. I will have to provide Internet to this apartment. I have come up with what I think will be the final network design, but I need some input to what device I should put in after the Cable Modem (see image “What to put here?”) in order to split the two networks. The networks need to be totally separated. And it would be nice if I could control the bandwidth to the apartment.

Here in California - telecom access is a requirement for the landlord to provide - so run a pair of telco wiring from the demarc block to a wall plug in the apartment, which should support both DSL and POTS - notice I say access, not service - the pair can be provisioned in the tenant's account by the tenant.

Alternately - an RG58/RG6 run could also be done - and most cable co's will provision the Modem/GW, again in the tenant's account...

Check the local laws - rental law can be very specific on the tenant's rights, and as a landlord, you can be subject to significant risks if the laws are not complied with - those laws are there to protect both the landlord and the tenant.

 

[sfx2000]

Also - check with your cable CO - they do have means to provision multiple access lines off a single drop - and they can do this at the modem itself - might require that you use their Modem/GW, and one of ports will be assigned to the tenants account for access and billing. But this is more complicated...

Another approach - if you've got CAT5 to the apartment - set up DSL access at the Demarc, and that CAT5 will be for the tenant - keeping in mind that the Tenant has to setup up the billing relationship with the carrier.

 

[KristianHN]

If you are in the US, unless it is physically impossible (out of pairs, too far, etc.), it should not be an issue. They will want a contract so that is why i suggested leaving it up to the renter.
If you have a landline, there is likely an extra pair going to the main house that could be used. If you have cable to the house, they will just split ahead of you and run the drop.
Have the cable and phone ISPs told you it is impossible to do ?

I'm located in Norway. Just to underline, it is not possible to get a separate phone line or cable TV line into the apartment, so it will have to be shared. Since this is Norway, I'm not afraid of any potential consequences of my tenants illegal downloads or kitty pron addiction.

Also - check with your cable CO - they do have means to provision multiple access lines off a single drop - and they can do this at the modem itself - might require that you use their Modem/GW, and one of ports will be assigned to the tenants account for access and billing. But this is more complicated...

Another approach - if you've got CAT5 to the apartment - set up DSL access at the Demarc, and that CAT5 will be for the tenant - keeping in mind that the Tenant has to setup up the billing relationship with the carrier.

There is a CAT 5 connection to the apartment, but only the possibility one internet connection point (located in the house). That is why I need some input on a device where I can keep the two network separated.

 

[EngChi]

Any router would work whether something you buy in your local electronics store or create yourself with many free distributions available (including pfsense). remember routers connect different networks together, your Linksys would do it.

Now, as others said - I think it is incredible short sighted to put complete and absolute strangers on your network including network you seem to use for work . Even if they do not do anything that illegal, do you still want to deal with reputation, brand, and other damages and be 100% responsible for ANY and ALL their online activity? Why??? Get a different ISP (surely there is more than one ISP in Norway), put them on the contract, and forget about the rest. A single incident (even if not illegal) would cost you a decade of rent if not more and permanently damage your reputation. if you play with fire - (eventually) you get burned, so don't play with it, and don't cheap out.

 

[degrub]

I'm located in Norway. Just to underline, it is not possible to get a separate phone line or cable TV line into the apartment, so it will have to be shared. Since this is Norway, I'm not afraid of any potential consequences of my tenants illegal downloads or kitty pron addiction.



There is a CAT 5 connection to the apartment, but only the possibility one internet connection point (located in the house). That is why I need some input on a device where I can keep the two network separated.

If there is a spare pair in the cat5 at the existing demarcation box on the house, the phone company should be able to install a second demarcation box for the apartment. Then you jumper or terminate your internal existing cat5 that runs to the apartment to that demarcation box.

Or perhaps they can just provide separate service over the spare pair without a new demarc box and you terminate to that pair.

Physically easy and avoids all the issues with firewalling and network management and meets your isolation criteria.

 

[L&LD]

KristianHN, have you actually contacted your ISP and asked for a second line?

Find it very hard to believe that it's not possible (from all the suggested ways above).

 

[KristianHN]

Any router would work whether something you buy in your local electronics store or create yourself with many free distributions available (including pfsense). remember routers connect different networks together, your Linksys would do it.

Now, as others said - I think it is incredible short sighted to put complete and absolute strangers on your network including network you seem to use for work . Even if they do not do anything that illegal, do you still want to deal with reputation, brand, and other damages and be 100% responsible for ANY and ALL their online activity? Why??? Get a different ISP (surely there is more than one ISP in Norway), put them on the contract, and forget about the rest. A single incident (even if not illegal) would cost you a decade of rent if not more and permanently damage your reputation. if you play with fire - (eventually) you get burned, so don't play with it, and don't cheap out.

Thanks for the input. My Linksys does not support VLAN's or QoS, so I just want to make sure that I buy a device that can separate the two networks.

Again, it is not possible to create a separate internet connection to the apartment. The copper line is such a bad shape that the possible internet speed is not acceptable and the cable provider will not install a new line into the apartment - so all please stop suggesting this. It is simple not an option at this house.

Also, the laws are different here. No matter what the tenants do, I can not be helt accountable, even if it is my connection. So this is not something I think about.

 

[EngChi]

ok, it is your life and I will drop that topic on tenants
back to your question - you want a router, VLAN set up, and some firewall rules in place to figure out what can talk to what.
Do you have any other equipment 'free' (not currently doing anything)? How interested are you in wasting your time with setting it up and messing with it? How important is performance and what do you need under performance (do you plan to run additional service handling packet inspection, etc)?

There is a build and there is a buy - for build people on this forum use a variety of hardware, anything from spare parts already available to running it in VM to going to buying a cheap utility box with multiple NIC . in USA, right now Qotum builds are very popular, they are relatively cheap, x86 (for they are reusable for another project if you want) , could be had with modern CPUs (14 nm generation) and configured with whatever memory and HDD/SSD you want. My most recent build was "Qotom-310G4", it is of good build quality, 4 network interface cards, current CPU, small, and reusable. I typically run PFsense on it (www.pfsense.org - a BSD based solution for firewall/router) and ended up using last Qotom as Windows domain controller

Now if you want to buy, there are many companies that will sell you pro-sumer router, my old pfsense box died so I went and bought a solution from Mikrotik specifically for router . I think there is a company in Norway (https://www.avantis.no/router/switch1 ) that sells Mikrotik/ubiquiti and some other solutions.

This is what I bought for myself
https://www.avantis.no/router/switc...ros-l4-plastic-case-and-psu-18800-p0000052353

 

[colecaz]

I have exactly your diagram set up in my house.

In the "what to put here" location I have a RT-N56U router connected so its WAN port receives a WAN IP address from the cable modem. Its LAN is setup up with the router address 192.168.101.1 and the DHCP set to give static IP addresses to the WAN ports of the sub-routers (RT-AC66U and RT-AC68P) of 192.168.101.2 and 192.168.101.3. And I have the DHCP range set for four addresses so I can use the LAN ports on the N56U for troubleshooting. Then the sub-routers are set up normally, as if they were connected directly to the cable modem.

This gives a double-NAT situation but that has to be so things coming from the internet get routed properly.

The wifi on the N56U is turned off and wifi on the two sub-routers takes care of their clients.

This was my solution when my ISP quit allowing home users to have two IP addresses.