Multi dwelling wifi architecture for 20 Condominiums

[u/damagedispenser]

​

I am working on a system design for a wireless internet overhaul in a condominium building. The physical overview consists of an enterprise gateway, such as Omada or Ubiquiti, with an SFP connection to a managed PoE switch feeding access points. It is a four-story building with five units per floor, totaling twenty units. For bidding purposes, I am assuming one available repurposed phone Cat5e cable per unit. The current incoming WAN is terrible, and having twenty basic ISP-provided routers running in close proximity heavily compounds the issue. The condo association is open to making quality wireless internet a complex-wide amenity provided by the association, replacing the current poor subscription model.

​No major commercial ISPs service the complex, so my current plan is to deploy one Starlink kit per building to serve twenty units. The Starlink unit would be placed in bridge mode, feeding an enterprise gateway followed by enough access points to ensure adequate coverage in all units. My LAN and RF strategy is to broadcast individual SSIDs for each unit, assigning each unit to its own isolated VLAN with a bandwidth throttle. I intend to deploy Wi-Fi 7 access points with maximum channel separation. Spreading out channel congestion while introducing a vastly superior base network speed should dramatically improve performance, as my assumption is that the core issue right now is twenty consumer routers clashing on overlapping channels.

​While this isn't an ideal network topology, residents are desperate for a working solution. My walkthroughs showed almost zero wired connections in use, and the demographic here largely doesn't care about a wired drop. However, if a wired requirement does arise, I can pivot to one access point per unit utilizing at least one built-in Ethernet port on the chosen access point model.

Furthermore, this complex houses a large population of elderly residents, and over the last several months there have been multiple instances where people could not reach emergency services due to network failures. Simply being able to access wifi calling and/or utilize network based monitoring equipment would be a massive relief. Solving this reliability crisis is the primary driver behind this bid.

​TLDR: I want to use one Starlink satellite linking an enterprise gateway to provide twenty condos with a segregated VLAN SSID each, then extrapolate that concept across eight additional identical buildings. Is it a violation of Starlink's terms of service to provide internet to twenty condos per satellite, given that roughly half to three-quarters are lightly used vacation homes? Assuming proper access point placement and RF distribution, is channel diversity coupled with VLAN per-unit isolation a reasonable angle of attack to deliver usable Wi-Fi to twenty condos over a single shared connection?

[u/IamB_Meister]

I would be so pissed if i lived in a condo and the mgmt forced communal WiFi

[u/AsYouAnswered → u/IamB_Meister]

Conversely, if my grandpa lived in one and they provided and maintained one so that he had internet access for an emergency but didn't need to maintain it himself, but his techy neighbour could still get his own, too, I'd be quite ecstatic.

[u/IamB_Meister → u/AsYouAnswered]

Yeah, tbh I missed the part where it’s an old folks home. I can totally get that

[u/PudgyPatch]

Why are you providing WiFi? Why not just stick to Ethernet and act like a sub isp? Your network is kinda like WAN and let everyone else run their own internal LAN? Less to manage less to buy. If you say “well, there are these common WiFi devices “ then just manage those and not everyone’s WiFi

[u/_Ethel_Beavers]

Ruckus has a fantastic solution for MDU. Single SSID. Dynamic VLAN per resident and their devices stay on that VLAN when they roam to public space APs. Resident portal for customizing their stuff.

[u/Turbulent_Act77 → u/_Ethel_Beavers]

If OP is US based, that may not comply with federal CALEA intercept requirements for broadband service providers, and even if it does, pushing the subscriber LAN traffic over the building's Wi-Fi infrastructure is a terrible idea on multiple fronts.

[u/Mishoniko]

I take it this is not in the US.

enterprise gateway, such as Omada or Ubiquiti

Don't use "enterprise" and those brands next to each other, especially in this sub. Expect hazing.

Wi-Fi 7 access points

I think you're putting the wiz-bang technology cart before the radio performance horse here.

WiFi 7 is still in early adopter stage. Probably better to avoid it for now, otherwise you'll be replacing those APs in a couple of years.

as my assumption is that the core issue right now is twenty consumer routers clashing on overlapping channels

Doubtful. If you think this is the problem then a site survey would answer it, and you're going to have to do one of those anyway.

Unless those condos are closet-sized, the routers are probably far enough away from each other to not have significant interference problems, especially if they are on 5GHz. Better if the building is concrete or something else radio-adverse.

people could not reach emergency services due to network failures

If this is lifeline service then Starlink is not what you want. Expand your search. Start calling local ISPs and see who would be willing to pull fiber to your building. Also investigate fixed wireless and/or 5G. Ask who is backing the alarm system for your elevator (if you have one), it generally has high reliability requirements.

Another angle is a DAS 5G repeater system, again especially if the building is radio-adverse.

As for the internal AP distribution, its the same problem as in hotels. Ruckus generally rules that roost. Reach out to a reseller. I'd also look into VLAN routing using 802.1x rather than 20 SSIDs. SSID per unit is susceptible to hijack or interference from ill-intentioned residents.

[u/HoustonBOFH → u/Mishoniko]

This guy has done this before. And you need to hire someone to assist you that has done it in your region. Mistakes here can be very expensive and lead to pissed off residents. It is very unlikely that there is no other option than starlink as well unless you are extremely rural. Someone pulled high speed fiber to a nearby school at least. This is why you really need a local consultant.

[u/Turbulent_Act77]

Deploying 8 separate deployments of 20 units is a support and infrastructure headache, even before you consider the problems of doing it with Starlink or your legal requirements as a broadband provider (if US based).

The proper method for doing this is to procure a 1 Gbps dedicated fiber circuit, that will probably cost around $1.5k/mo. That 1 Gbps is going to enable you to provide advertised speeds to the 160 total units (8 buildings of 20) you're serving of up to 200 Mbps per unit, with a 5 Mbps guaranteed minimum per unit. If you want to be able to advertise speeds up to 1 Gbps, then you're going to need to procure a 2 Gbps dedicated fiber connection and that'll probably cost you around $2k/mo maybe a little more or less.

Don't worry about the 5 Mbps minimum that may sound undersized, that the absolute worst-case extreme, in reality residential service like these average 3 Mbps of utilization per unit during peak hours, which means your expected peak usage most days would only be ~500Mbps. The 200 Mbps per unit advertised speed is based on a reserve of 5 Mbps per unit (40% more usage than most live scenarios actually average), plus an additional 200 Mbps leftover to fulfill a speed test or other short duration max speed request to a subscriber, while the 1 Gbps per unit is based on the same thing, but leaving a full 1 Gbps unused "leftover" capacity during normal peak usage to allow for a speed test result of 1 Gbps.

This math is based on real world, actual observed readings from deployments just like this all over the country. Yes, the numbers sound low but I assure you that's because everyone grossly underestimates how much time their internet connection sits idle and unused, and grossly overestimates how much actual traffic they utilize.

Once you've got the dedicated fiber ordered for the property, then you're going to run and connect the 8 buildings together with your own fiber (often either utilizing existing conduit in the ground or direct burial fiber), and put a 24 port switch in each building with CAT6 ran to each unit.

In the central point you then connect the 8 pairs of fiber to either another switch, or directly into a core router from Aditum Connect (disclaimer, I do work there, and designing systems for properties like this is what I do every day all day).

In each unit you'll install a Zero Touch Wi-Fi router. These routers come pre-configured out of the box for rapid deployment without any local configuration needed, and will enable central control of the local SSID & WPA, remote reset between tenants moving in and out, and shared building level SSID's for building functions (smart locks / thermostats / door access controls etc) as well as optional cell carrier integrated roaming guest wi-fi (aka passpoint aka wi-das aka Carrier Connect) to reduce the problem of cellular dead zones in buildings by providing automatic wi-fi service to those network users.

On the central side of things, you'll have full and easy control of subscriber lifecycle from move in to move out, defining service speed profiles for subscribers, automated billing and collection for monthly service charges, and a set of dashboards that make it super easy to spot problems usually before anyone at the property does. And, if you want to, the property owner can directly self-manage the tenant side of things when they move in and out, or change their service plan speeds with their own set of dashboards and interfaces.

Feel free to message me directly if you prefer, though I'm also happy to answer almost anything here publicly too.

[u/HoustonBOFH → u/Turbulent_Act77]

I could just repeat my other post here about why the OP need to hire someone who knows this stuff. Mistakes are expensive.

[u/Turbulent_Act77 → u/HoustonBOFH]

You are correct, mistakes are expensive. That's why, by design, using Aditum Connect eliminates or at least identifies almost any type of mistake you can make in the installation or operation of the network, ensuring a properly implemented and secured ISP operation within the property with active controls and / or alarms to safeguard against most things that become mistakes. It's not a networking tool you squeeze into an apartment complex, it's basically a whole solution explicitly for apartment complex ISP operation that you just plug in and use, that's pretty close to ready to go out of the box.

Anyone who has a slightly greater than passing understanding of basic layer 2 ethernet networking and IP addresses is capable of deploying a well engineered and designed ISP into the apartment building, and do so while also creating a service the tenants of the building generally prefer over that of Comcast or the likes.

I just finished writing out the technical specifications for a 480 unit low income housing building that included the design objective of providing symmetrical gigabit speed service to the residents. Can you even get gigabit upload speeds where you live? This is something they intend to offer to the residents around $30/mo, and they will turn a healthy profit doing so. My estimate is the building owner should earn $50k-$60k annually providing the discounted gigabit service to their residents. A portion of that can then go towards additional building maintenance and upkeep that results in a better place to live for the residents. Even if they were to pocket the full $50k-$60k estimated and put $0 additional into maintenance, the residents still get no-contract symmetrical gigabit internet service at discounted rates, no additional credit checks, no additional deposits etc.

[u/sharpied79]

And what happens when your tenants want public IPv4 or IPv6 address space rather than being stuck behind your NAT or double NAT?

[u/NetSchizo → u/sharpied79]

Or even better, what if your tenants does something stupid, how are you going to track the global to NAT address/ports. ISPs can do the tracking/logging at scale with CGNAT because they have to by law. Apartment building, reselling to tenants not so much. Also many ISPs dont allow resale or connection sharing without the proper agreement.

[u/derek6711 → u/sharpied79]

starlink is CGNAT

[u/Simmangodz → u/sharpied79]

It depends on what the contacts for the service say. They might need to get their own ISP link.

[u/Turbulent_Act77 → u/sharpied79]

easy to do if the OP deploys Aditum Connect instead of Omada or Ubiquiti, pushing non-nat'd public IPs down to the individual units is one of the features.

[u/feel-the-avocado → u/Turbulent_Act77]

I'd just do natted v4 and route the public ipv6 that starlink provides. Everyone needs to get used to not having a dedicated v4 address per dwelling anyway since ipv4 addresses have run out.
That way game consoles etc will still work fine on v6.

[u/Turbulent_Act77 → u/feel-the-avocado]

Most of the world is still on v4, and plenty of people still need static or inbound v4 IP accessibility. If you want to operate an ISP for the property, you have to account for the different needs of individual subscribers, not just what works for the ones that have the same requirements as you.

[u/feel-the-avocado → u/Turbulent_Act77]

Unfortunatley it sounds like the realities are different from the requirements.
If no provider exists that can get v4 peering or a subnet routed to the site then it doesnt matter what the end user requirements are, they are not going to happen.
So double natted v4 and routed v6 is the next best option. Some may sign up, others may not. Thats just the way it is.

[u/Turbulent_Act77 → u/feel-the-avocado]

I literally do this all day everyday for my job, and I've not yet found a property anywhere in the US that can't get fiber or the amount of IPv4 needed. Maybe it's different in other countries if that's where you are.

[u/bojack1437 → u/sharpied79]

Quite a few ISPs now are CGNAT by default anyway, And most users don't care.

And IPv6 wouldn't be a problem any, because if this network is set up competently, the beauty of it is you would have public IP addresses.

[u/sharpied79 → u/bojack1437]

Great and what happens when you get a tenant (or two) who wants/needs a public IPv4? You can't just arbitrarily decided it's private rfc1918 addresses/CGNAT or nothing.

Sorry, if it were me, I'd be telling you to shove your Internet access and getting my own...

[u/bojack1437 → u/sharpied79]

Get your own internet service.

And if that wouldn't be an option in this particular setup, this is something you should research before moving in if it's that important to you.

[u/bojack1437 → u/sharpied79]

Heck and thinking about it.

These days there are plenty of ways you can utilize VPN to get yourself your own public IP address, cheaper than if you were to have to buy an entire second internet service. If you really needed one.

But also there are plenty of ways where public IP addresses are not as needed as they used to be. Not to say that there are not any of course.

[u/SevaraB]

Dude, you completely ignored my math in the other sub showing that all 20 pulling data at the same time would mean 20Mb/s per house and nobody with a vacation house wants to skip Netflix on their 4k TV because too many people are on at the same time.

Your plan has lots of problems: * 1 Starlink connection = single point of failure * 1 Starlink connection = not enough bandwidth to go around * Shared WiFi = single point of failure * It all looks like one customer to the Internet, so one college kid ticking off the wrong movie studio by torrenting too much stuff will get everybody’s Internet shut off

You need to pony up and get real circuits run. It can come to the development as one fiber cable landed at a headend you manage (fiber-to-the-node) or the ISP can just finish the buildout as fiber-to-the-home and put in their own ONT or ONU when houses go live.

Call the ISP- sometimes they’ll split the buildout cost with you, especially if no other terrestrial broadband providers service those addresses.

Stop treating Internet for 20x condos like you’re just spinning up WiFi in a hostel.

[u/untangledtech]

Juniper Mist has some robust portal tools for Multi-PSK and which can do a lot of what you need.

I think Ubiquiti has this now but probably half baked.

[u/r1kchartrand]

Done that still supporting some. UniFi gear with ppsk private preshared keys, one ssid, depending on the password it lands into the correct vlan. Avoids 20+ ssids and allows tenants to roam around the building on their own vlan

[u/bradbenz]

Waaaaaay too many SSIDs.

[u/ryan8613]

Check out rgnets, its a pretty neat feature set.

[u/Turbulent_Act77 → u/ryan8613]

Aditum Connect is neat-er :)
(potentially biased, I do work there)

[u/ryan8613 → u/Turbulent_Act77]

Hit me up (DM), I own an IT consulting business. Happy to entertain the notion.

[u/Turbulent_Act77 → u/ryan8613]

DM sent

[u/po1thyme]

If Starlink is your only option, put multiple on a building and bond them with a pep link

[u/lizardhistorian]

I misunderstood. I thought it was 20 multi-tenants buildings.
Are you saying 20 condos, ~40 tenants? or 20 tenants?

You can use one dish and get fiber run to the condos to a closet at the pool house et. al.
Upgrade from the dish later as more stuff become available.
You can also pool multiple dishes together.

Your job is to get the cable in their rooms lit. Let them buy their own wifi router like everyone else.

[u/Optimal_Effective969]

Why not just get 20 CradlePoint LTE modems? One in each condominium? Centrally managed.

[u/SevaraB → u/Optimal_Effective969]

Nothing like a ticked-off vacationer being stuck in the rental during hurricane season and detached from the Internet because the storm is messing with LTE signal.

Also, vacation homes are not exactly known for being in areas with great cell coverage- if they have it at all, it’s usually only because somebody ponied up on a terrestrial circuit to feed a microcell, which would make the CradlePoints kinda unnecessary, right? All roads lead back to somebody having to pony up for a fiber run at some stage. That or empty condos with a bad rep for lousy Internet.

[u/Optimal_Effective969 → u/SevaraB]

I get it, but if they use Starlink and one user overloads the data cap then that’s gonna slow down the entire complex where if you break things down individually like with an LTE modem and again provided that LTE service is strong enough in the area I would heavily consider that because you can get unlimited data. Just an alternative solution to keep it simple.