reply to VCWireless
Re: Total subscriber isolation One thing to consider is provisioning a VLAN per customer. You could configure a private /30 for each VLAN, handing out 1 usable IP address. From there you could do a 1:1 NAT, which shouldn't cause issues for anyone.
You can do a VLAN per sub using that method and you won't be burning through a ton of public IPs, assuming you're just assigning 1 public per sub.
Obviously without NAT you'd be looking at burning up a public /30 per VLAN.