In an appartment building we need to share common equipment (IP intercom with video stream, SIP server, internal web server) with multiple households. Each household has its own internet connection and network stuff.

Households should be able to access the shared equipment but not each others network.

The idea is to have the shared devices/intercom sip server in a separate network, connected to a switch. Also each household gets one cable from this switch.

I am looking for some pointers to help us on the way. Perhaps this type of network has a name?

  1. How can the household networks 'see' the equipment that is shared?
  2. Is it possible to connect the shared network cable to a WiFi router in the homes (after some configuring), and if yes how is that 'configuring' called? If no, what kind of equipment do we need?
  3. Households should not be able to access the networks of the others, how can we prevent this?
  4. Equipment in the shared network must be able to communicate with the household networks (for example when there is a call the sip server must be able to pass the call).

Edit: a small diagram to show the intention.

ISP---internet modem home 1---switch----------->cable h1
                               | | |
                         home 1 equipment like printers..

ISP---internet modem home 2---switch----------->cable h2
                              | | |
                         home 2 equipment like printers..

cable h1---shared switch---shared equipment
cable h2----           

Home 1 should not be able to communicate with home 2, but it should communicate with shared equipment. Personally I think the shared equipment should be in a VLAN, as well as every home. Then the 'shared switch' should have some kind of access rules to allow communication between VLAN shared and VLAN home*, but not between VLAN home* and VLAN home*.

Is this correct? How do the homes know how to access the shared switch when they are in a different ip range?


This is more a comment but too long so have to put as an Answer.

So you have common shared services that have separate entities for each household. A bit like a Datacentre has multiple Servers for different clients but they cannot access each others?

I think you need to split the Services apart so rather than throwing them all in one topology you need to think about which ones are shared open and which are shared in isolation. For example this web server what is it going to host? I guess one website all the households can view therefore it can be 'open' to all.

The SIP Server can setup using forwarding to push telephone numbers to a specific IP so no household visibility is required they will simply get a number for VOIP and that's that. I would need to know a little more about the IP intercom with video stream to really give my opinion.

Most likely you are going to be looking at a situation where you have this topology:

Outside world > Firewall > Shared Services > Firewall > Open Services > Household...

The wireless can be configured once each household has a cabled connection...


  • Thank you for your reply. The shared equipment is only for households, and does not need/have access to internet. So we have households that have networks like any household, only with a shared piece of network. In the topology described there is one common internet connection, which we do not have. Does the topology still hold? – Lennart Jun 27 '14 at 10:45
  • Right ok so no internet needed for the shared services, what about the SIP is that just for the door system, etc. Doesn't need to contact an external PBX for calls? So can this network be completely separate to the households networks? What will the end user get from this network a cable or a video conference screen with audio, etc? It sounds to me like their own internet network is a separate entity and this needs to be a separate entity too... is that correct or do you want only one network inside the households that can access both? – CharlesH Jun 27 '14 at 10:58
  • Each home has its own network. All the home networks together should be able to access a shared network, but not each other through the shared network. See my edit, hopefully it makes it a bit more clear. – Lennart Jun 27 '14 at 13:41
  • Much clearer just one last question! How will the shared switch---shared equipment be presented to the household, are you planning on providing an ethernet cable which will connect to the household's current switch? So they will have ISP > Router/Modem > Household Switch Port1 and Shared switch > Household Switch Port2..? If so how much influence do you have over the household's networks, are you able to change their IP ranges to suit your needs or is that their choice? You can split it using VLAN's as you mentioned but they need to be able to carry that VLAN tag with their own equipment. – CharlesH Jun 27 '14 at 14:22
  • The other way you can do it without causing any 'distress' to the households is using a firewall 'as mentioned' internally and only allowing traffic to its destination via MAC address.. The only annoyance is that if they change their router/switch, etc. they need to supply the new MAC address and get a change made on the firewall. – CharlesH Jun 27 '14 at 14:25

The solution is as follows. First, every household gets a separate VLAN. The shared network also gets one.

Centrally we will use a switch with VLAN access control. Every household gets a switch that routes known ip addresses to the central switch and all other traffic to the internet modem. We will supply ip addresses from a central DHCP server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.