I'm preparing a network setup for a building with five apartments and some common infrastructure, and being no network professional I'm stuck with the question of topology and overall setup that would accommodate all the necessary stuff together with a bearable level of security (family photos on a local NAS box not freely accessible from the Internet, for example).

Let's start with an artistic impression of the intended setup:

Private network topology

The idea is that each apartment has its own local network with the usual mix of smartphones, computers, NAS boxes, printers, smart waste bins etc; none of which should be accessible from outside of the LAN.

Then there are the common services which should be accessible throughout the building, from inside the LANs (some of them in the DMZ with provision for access from the outside). For example, each client connected in any of the separate LANs should be able to access the weather station server or the CCTV archive.

I also have a building-wide network of Siemens Gigaset VoIP base stations. I'd like to connect them bases physically to the separate LAN routers (I can't install their own wiring from the main router), but they need to be on the same network to be able to talk to each other for the roaming to work.

The main problem for me is the accessibility of the 'common' network from inside the separate LANs, since the typical private ranges of IP addresses are usually not routed (or routable) through the usual SOHO routers and I don't have the budget for full blown professional setup (and people to set it up for me and come whenever something goes beep).

And the question is how can I set such a network up? I'd like to keep the budget low, but if there is a Magic Box TM that will set it up for me, I can pay the adequate price.


I want to avoid at all costs any 'virtual' or 'cloud' solutions. The network must be functional even when there is no Internet connection available. Every piece of equipment so far present is purchased with this in mind, and I really don't want to cloudify the whole property.

Since IPv6 is supported neither by many of important devices nor by my own knowledge (or, better, lack thereof), I'd like to have the whole setup solely on IPv4.

There will be two Internet connections, one main and one backup (I'm thinking about one of the little Ciscos with two WAN ports for this role.).

Firewalls left out from the diagram (and question) for the sake of simplicity, but feel free to comment on them whenever relevant.

Sorry for my dummy language, should something need clarification or elaboration, please comment, I'll try to respond quickly.

  • Questions about home networking are specifically off-topic. You should ask this on Super User. Also, double-NAT will cause no end of problems for some home users. – Ron Maupin Jan 8 '16 at 16:08

This is a relatively simple setup that can be done with any soho (wireless) router. You have to adopt the example ip addresses I use in this answer to you actual setup and modifiy the subnets to suit your needs:

  • Router 1 set up with IPv4 Network:
  • Router 2 set up with IPv4 Network:
  • Router 3 set up with IPv4 Network:

Each apartment router is connected to the main router (preferably a L3 - Switch), optimally on its own VLAN. Also connected to the main router and also on its own VLAN is the "common" - Network, lets say, and your internet connection(s).

The main router has an interface in each network. The apartment routers default route is the main router. The main routers default is, of course, the internet connections next hop.

Lets say, for example, the main routers interface IP in the apartment 1 network is On the apartments router, you would have a default route like: mask gateway

If you want to publish something from the common network to the internet, you'd either have to setup reverse NAT or an additional DMZ network. The DMZ network only makes sense if you have more than a very few services to publish and more than 2 public IPv4 address.

With this setup, your mission is nearly accomplished.

The tricky part is the VoIP. There are a few possible solutions, depending on the apartment routers features (make/model?).

Best solution would be to create an additional VLAN for VoIP and configure the uplink port of each apartment router to the L3 - Switch (main router) to tag all VoIP - Traffic and send all other traffic untagged. On the port of the main router you have to set up a default vlan for the untagged apartment traffic for each apartment. But this demands an apartment router where it is possible to individually configure (LAN)ports on the device and it must support 802.1q.

  • That looks very promising, thank you! I don't have any of the routers yet, so I can pick ones according to your advice (with the configurable LAN ports). The reverse NAT is a good idea, too. – Pavel Jan 8 '16 at 15:49
  • You're welcome, always glad to help :) If you're going to buy new equipment, you might want to look for some 802.11n/ac capable. Then you could use wifi for voip with good quality and don't have to stick with dect-voip and remove the gigaset devices from the setup. Just an idea ;) – Sebastian Jan 8 '16 at 16:26
  • That is what I originally planned, but that wouldn't work. Gigaset's coverage quality is hard to beat with the same number of (even very high quality) APs, and I want to have a separate key (or even better, key set) for every appartment, which would make roaming cumbersome. – Pavel Jan 8 '16 at 16:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.