What a Modern Apartment Building's Internet and Wi-Fi Should Look Like

Not a technical manual – just the view of a resident with an IT background on how internet, Wi-Fi and mobile coverage should be planned in a new residential complex today

Location: Cordia Woodland 1 – L-shaped floors more than 60 metres long

Starting point: weak mobile coverage; cameras, EV chargers and community room devices on the building's network

Proposal: separate networks, two providers, a central firewall, Wi-Fi on the floors and in common areas

I live in the Cordia Woodland complex, and I see up close how the building's shared network works: cameras, EV chargers, the community room. I kept thinking that this could be done more simply, more securely, and in the long run more cheaply.

This page isn't a complaint, it's a proposal. I've worked in IT for more than 25 years – as a project and programme manager, with a focus on IT security as well – and I've built IT infrastructure for apartment buildings myself. So here is how I picture a modern building's network – with as little jargon as possible.

Why Coverage Matters on the Floors Too

The floors in Woodland 1 are L-shaped, and from the 5th floor up the buildings are connected. A single floor is therefore more than 60 metres long. In a corridor that long, built of reinforced concrete, mobile signal runs out fast.

It's not only residents who notice. Maintenance staff and cleaners also complain that they can't make calls inside the building. In my own flat, for example, there is practically no mobile signal.

This isn't about convenience. If someone feels unwell in a corridor or stairwell, or a maintenance worker urgently needs to call for help, missing coverage becomes a safety issue.

How It Would Look If Done Properly

Picture an office building where every company has its own locked floor, and a receptionist at the entrance decides who can go where. A modern apartment building's network would work the same way: each group of devices works on its own separate "floor", and a central firewall plays the receptionist.

Technically, this is called VLAN separation: for security and operational reasons, each group of devices – cameras, EV chargers, community room devices and the resident/guest Wi-Fi – runs on its own network. I've summarised the details in a short IT explanation at the end of this page.

                            Why bother? If someone hacked a Wellcharge charger from the internet, they would only reach the chargers' network – not the cameras or anything else. Traffic between networks is controlled by the central firewall, so only permitted connections get through. It also makes operation and troubleshooting much easier.
                        

Today almost every device – charger, camera, access control – connects to some cloud service. Each of those connections is another door into the network. The more doors there are, the more important it is that they don't open into each other.

Two Internet Lines, One Central Firewall

Both internet lines should be connected to the same central firewall. That way traffic can be shared between them, and if one provider goes down, the system automatically carries on over the other. Ideally, residents notice nothing.

It's the same lesson I learned the hard way at 4 a.m.: a backup is only worth something if it is truly independent of the primary connection – different provider, different path.

Coverage – Wi-Fi and Mobile Signal

The coverage problem will certainly keep coming back. It would be far more professional to have Wi-Fi available on the floors and in the common areas as well.

On a well-covered Wi-Fi network, phones can make calls without any mobile signal using Wi-Fi calling (VoWiFi), which most Hungarian providers support. Interestingly, that is exactly what Telekom recommended to me for inside my flat. But VoWiFi is only as good as the Wi-Fi coverage behind it.

An indoor solution agreed with the providers is another option for improving mobile coverage.

Important: you must not install your own mobile signal repeater without authorisation. That is a matter for the providers and the authorities.

In my view the planning also went wrong here, and Pedrano shares the blame: the passive equipment needed for indoor coverage wasn't designed in, and the telecom providers weren't consulted in time. I still don't understand this – in a complex with several hundred flats, it should be a basic requirement.

Looking Ahead – Woodland 2 and Woodland 3

Woodland 2 and Woodland 3 are on their way. It's worth asking the question now: will every new building get its own, separate internet subscriptions? Or will a shared, consistently designed and managed infrastructure be built? The latter is cheaper, more secure and easier to operate in the long run.

It could also be a real competitive advantage for Cordia:

Full Wi-Fi coverage everywhere – even in the lift.

The problem isn't unique to Woodland, or to Cordia buildings. That is exactly why it could be a real differentiator if it were considered at the design stage.

From My Own Projects: How It Worked in Practice

Earlier I built IT infrastructure for apartment buildings of 5 to 50 flats in Districts XI and XII. There, UTP cable ran to every flat, and the building had internet contracts with two different providers, which many residents actually used.

For an average household this was more than enough – even during Covid, when streaming traffic shot up. When one provider went down (and there were plenty of examples), residents didn't even notice, because the system kept running on the other.

Why the Provider's Router Isn't Enough

The routers supplied by providers are essentially built for home use – they aren't designed to run a system with several device groups, multiple lines and hundreds of users.

Even in my own flat I've disabled the Wi-Fi on the provider's device and use my own Wi-Fi equipment and firewall. That way I decide what connects to my network and what can reach what.

In Short: How I Picture a Modern Building's Network

UTP cable to every flat.
Two different internet providers, one central firewall, automatic failover.
Separate networks per device group – cameras, chargers and residents shouldn't see each other.
Centrally managed Wi-Fi in corridors, stairwells, common areas, the garage – and even the lift.
Cameras on cable, with PoE.
Mobile coverage through an indoor solution agreed with the providers – at the design stage, not afterwards for a fee.
One consistently designed infrastructure for the whole complex, from Woodland 1 to Woodland 3.

                            The bottom line: in a new residential complex, internet, Wi-Fi and mobile coverage are utilities, just like water or electricity. If they're left out at the design stage, fixing them later is always more expensive – and it's always the resident who pays.
                        

IT Explanation: VLAN Separation

A VLAN (virtual local area network) creates logically separate networks within a single physical network. In a residential complex, for example:

VLAN 10 – camera system (Hikvision devices and the recorder)
VLAN 20 – Wellcharge EV chargers
VLAN 30 – community room devices
VLAN 40 – guest/resident network, where connected devices can't see each other
VLAN 99 – management, accessible only to the operator

A centrally managed Wi-Fi system can also broadcast these as separate Wi-Fi networks (SSIDs). Cameras, however, are best connected by cable with PoE, because it's more stable and more secure. Traffic between the networks is controlled by the central firewall.