Upgrade Apartment Intercom (with Ethernet?) and Mesh Wifi - Any suggestions?

[Zucca]

As always when mansa write about network stuff my jaw touch the floor as always....
Thank you so much... I still have to digest all your information.

I will probably go on the cheap boat with pfsense on this mini pc 8GB ram 32GB SSD (what a waste, 8GB could do it) will be the router and will deal with all my private vs guest needs.
For the main switch I will get a stupid ass SOHO Netgear 1Gb 12 ports or something like this.

[David Hess]

Considering the cost and complexity, it is likely better to just implement a faster LAN instead of traffic shaping.

[Zucca]

1Gb LAN internal, after POE Switch 100Mb which is fine for an apartment.
I will have something like 100Mb download and 20mb upload VDSL for the entire building (9 apartments total), so traffic shaping (even a stupid pfSense one) for the guests is a must.

[mansaxel]

Considering the cost and complexity, it is likely better to just implement a faster LAN instead of traffic shaping.

I fully agree. Nothing beats the quality of service you get from dealing with all forwarding requests. Throwing away or delaying traffic (which is what one does if "QOS" is applied) will always come as a distinct second to the preferable solution.

In this situation, where there is a choke point at the WAN connection, I think that the first order of battle is to prioritise short packets on departure from our network. The small ones, like SYN, and more so ACK, are important for TCP. If we make certain they won't be dropped as often as other traffic, we're in a better situation. Moreover; this rule applies to all traffic. You don't need to sort the good or bad out.

[Zucca]

Thank you for sharing my pain, but I can't change the WAN bandwidth.
It is what the italian telecom system is giving me and for copper it is the max I can have.

Until I will have a fiber coming into the building that's about it.

Now I need to buy a lot of 24AWG Cat6 cable. According to my investigation there are no 24AWG Cat7, and max I can have with 24AWG is cat6.

[Zucca]

https://www.eevblog.com/forum/testgear/test-equipment-anonymous-(tea)-group-therapy-thread/msg3393214/#msg3393214

Regarding the indoor monitor, this

https://www.aliexpress.com/item/4000566211914.html

can not block outgoing call so the apartments can call each other,  . I do not want that.

Looks like the NT-IP-G9W from BEC Integrated Solutions can do that.... there is still hope.

 

[mansaxel]

The NT-IP-G9W includes Intercom and Mobile Phone Calling using our managed SIP server, free phone technical support and even remote management from our secure office if needed.

In my book, that's a back door. Supposedly, their remote solution is unencrypted and has the password "letmein" and it is impossible to turn off or change the password.  Bogus alert phrase: "our secure office" -- WTH has their ability to lock their office to do with securing traffic over the Internet?

OTOH, the chinese OEM unit likely has similar problems.

These devices can only be dealt with by compartments, so that they're left to play in a shallow pool where they only can talk to our devices and nothing else. Then, all external connectivity is proxied (no, not NAT'ed, this kind of crap requires a full L7 protocol aware proxy; with NAT it'll call home and set up a reverse proxy in no time) through something we control and regulate. 

For SIP signalled multimedia, there is a broad spectrum of software available, like Asterisk or its web frontend package FreePBX (it is an Asterisk inside) that can do this proxying, including acting as a B2BUA (back-to-back user agent, a full proxy between two calls, one internal, one external). Normally (I once built a SIP based audio transport system for broadcast use) I'd stay away from the B2BUA and such, because it can lead to media conversion and delay, but in your situation it is probably the least painful.

[Zucca]

Thanks mansa....
Of course the General Police Commander pfSense could create a rule to stop some unwanted communications between WAN and LAN but yeah you are right better not to have to deal with that in the beginning.
Prevent a disease better than cure it.

After looking at prices I will step down to the BE-D5S and BE-5W... I will now investigate in details how those two puppies works....

[Zucca]

After looking at prices I will step down to the BE-D5S and BE-5W... I will now investigate in details how those two puppies works....

Crap they are just CAT5 devices, not IP ones... so I can't integrate them in a network.

[Zucca]

This cable CAT6 S-FTP AWG26 Stranded Copper could be an option, I hope it will not destroy itself when I pull it through the duct.