I'm preparing a network setup for a building with five apartments and some common infrastructure, and being no network professional I'm stuck with the question of topology and overall setup that would accommodate all the necessary stuff together with a bearable level of security (family photos on a local NAS box not freely accessible from the Internet, for example).
Let's start with an artistic impression of the intended setup:
The idea is that each apartment has its own local network with the usual mix of smartphones, computers, NAS boxes, printers, smart waste bins etc; none of which should be accessible from outside of the LAN.
Then there are the common services which should be accessible throughout the building, from inside the LANs (some of them in the DMZ with provision for access from the outside). For example, each client connected in any of the separate LANs should be able to access the weather station server or the CCTV archive.
I also have a building-wide network of Siemens Gigaset VoIP base stations. I'd like to connect them bases physically to the separate LAN routers (I can't install their own wiring from the main router), but they need to be on the same network to be able to talk to each other for the roaming to work.
The main problem for me is the accessibility of the 'common' network from inside the separate LANs, since the typical private ranges of IP addresses are usually not routed (or routable) through the usual SOHO routers and I don't have the budget for full blown professional setup (and people to set it up for me and come whenever something goes beep).
And the question is how can I set such a network up? I'd like to keep the budget low, but if there is a Magic Box TM that will set it up for me, I can pay the adequate price.
I want to avoid at all costs any 'virtual' or 'cloud' solutions. The network must be functional even when there is no Internet connection available. Every piece of equipment so far present is purchased with this in mind, and I really don't want to cloudify the whole property.
Since IPv6 is supported neither by many of important devices nor by my own knowledge (or, better, lack thereof), I'd like to have the whole setup solely on IPv4.
There will be two Internet connections, one main and one backup (I'm thinking about one of the little Ciscos with two WAN ports for this role.).
Firewalls left out from the diagram (and question) for the sake of simplicity, but feel free to comment on them whenever relevant.
Sorry for my dummy language, should something need clarification or elaboration, please comment, I'll try to respond quickly.