genexpieguy wrote

As such, I have set up two additional networks on the UniFI UAP-AC-PRO with SSIDs rdwAP229 and rdwAP235. rdwAP229 is tagged for VLAN ID of 229, and rdwAP235 is tagged for VLAN ID of 235.

So after this is set up the SSIDs of rdwAP229 and rdwAP235 are being broadcast and I can connect to them without issue. However, no IPs are being served, which I assume is due to the VLAN IDs and the current setup of the MTU VLAN being insufficient to handle them. Without an IP, the devices are unable to connect to the internet.

To use additional networks your router needs to support either different subnets or so-called Multi-Net-NAT (as TP-Link's routers implement it) and needs to be VLAN-aware. Many routers support a second (guest) network which can be assigned to an Ethernet port (therefore avoiding VLAN-awareness), but you would need three networks here: your own network and the two networks for the tenants.

Another alternative would be to split a common IP range in three parts handled by different DHCP servers and using Access Control Lists on an AP to secure the subnets. This way, one network could be used, but I don't know wether the UniFi AP can manage ACLs.

A third, but not so elegant alternative would be to use separate routers for each network.

Before thinking of an 802.1Q setup for your switch you need to decide how to separate three networks and three DHCP pools on the router and how to pass VLAN IDs to the switch (if using the single router method).

genexpieguy wrote

Asus OEM router firmware does not support what you describe. I might look at some of the open source stuff we briefly discussed in another thread, but I think that it's just going to be easiest to bite the bullet and purchase a UniFi Security Gateway (about $115), which I know will solve the problem.

That's a good decision. An alternative would be the UBNT EdgeRouter X, which also supports several networks and VLANs, has a nice web UI and costs about 45$. Make sure to update the firmware to latest version before setting it up, it will add more functions. It runs a full-fledged Debian Linux (Open Source) and you will have unrestricted access to the operating system.

I don't know the UniFi Security Gateway, but from the product site I saw that it's just a router with an integrated firewall and a VLAN-aware LAN Ethernet.

So it is suitable to replace your ASUS router and directly connect to the cable modem through its WAN port. You have to set up the UniFi GW with the credentials used in the ASUS router to connect to your ISP. Alternatively you can connect the UniFi GW to the ASUS router's LAN if you wish, but it will work as a router meaning you end up with two more subnets on your UniFi APs if you don't change the gateway's config to allow access from the ASUS private LAN to the private wireless subnet on the APs behind the UniFi gateway.

The TL-SG105 is then connected to the LAN port of the UniFi. This link can be a trunk meaning it can carry data for your separate private and guest subnets. SInce you wrote you would like to expand a wired/wireless private network with a guest network, I did recommend the EdgeRouter, which also has a 5-port VLAN-aware switch built-in and would fit perfectly, but certainly you could configure the UniFi gateway for this task, too.

As for IP addresses: strictly speaking, no, you don't need to run a DHCP server if you use static IPs. But for mobile devices of your guests a dynamic IP address (i.e. DHCP) is more suitable. For stationary devices, a static IP address is better. The switch should have a static IP, as should the UniFi gateway, too.

If you really get a /28 subnet from your ISP (16 IP addresses) on a modem, this are most certainly public IPs. Don't connect any device directly to the modem, use a router to secure your private network from public access over the Internet! The ASUS router does exactly this.

If indeed the ASUS router uses this netmask on its LAN, this is unusual. It should have a single IP on the WAN side and 256 IPs (netmask 255.255.255.0) on the LAN side.

Maybe you better draw a picture what you want to achieve. Setups can be anything, so first think about network topology, then select which device is to connect where and configure it. You will need: a modem for Internet access, a router (ASUS or UniFi gateway) for separating your network from the Internet & supporting two subnets and a switch behind the router to distribute those two subnets to APs and other devices.