Guest Wi-Fi that does not put your business at risk

A separate password is not a separate network

Most guest Wi-Fi in a Tricity office is a second SSID sitting on the same broadcast domain as the accounts department. It has its own password, which feels like separation and is not: the guest device takes an address from the same DHCP scope, sees the same ARP traffic, and can reach the same file shares, printers and recorder as a staff laptop.

Separation means a VLAN with no route to the internal subnets and a firewall rule that states it. Tagging guests into VLAN 40 and leaving inter-VLAN routing enabled is the version that survives a glance and fails a scan. The test takes a minute: from a guest device, try to reach the file server by IP address. If it answers, you have a second password, not a guest network.

Client isolation, and the two things it breaks

Turn client isolation on so guest devices cannot see each other. Without it, one laptop with open shares is visible to everybody else in the building, and a phone carrying something unpleasant has every other device in the same subnet to try.

Isolation does break discovery, and that is worth deciding deliberately rather than finding out in a meeting. Casting to a screen, AirDrop and a visitor wanting to print all depend on devices seeing one another, or on mDNS being forwarded for them. The usual answer is a third network holding the meeting-room display and the visitor printer, reachable from the guest VLAN and isolated from staff, rather than switching isolation off across the whole SSID.

Why the ISP router is not enough

The router your provider left behind does address translation, and its guest-mode checkbox ranges from genuine isolation to a cosmetic label depending on the model. It has no per-client bandwidth control, so one visitor downloading a game takes the link your billing counter shares. It has one radio pair and starts struggling somewhere around a dozen busy clients, which a reception area on a Monday morning passes before lunch.

The more serious problem is that the same box is your edge. A visitor sitting in your waiting room can reach its management page on an internal address, and on a great many of these units the password is still the one printed on the sticker. UPnP is usually enabled by default, which means any device on the network can open a port through it without asking anyone.

Your internet connection is registered to your business, so a complaint about traffic leaving that address arrives at your reception rather than the visitor's. A captive portal that records which device held which address at which time — a mobile number and an OTP is the usual form in Indian hotels — is what lets you answer it.

Hotels, schools and clinics need different things

One phrase covers three different problems, and the difference shows up in the survey rather than in the equipment list.

A hotel is a coverage problem first. Signal has to get into rooms through brick and reinforced concrete, and a corridor access point every third door leaves the far corner of the last room unusable. Rooms with a television guests cast to need mDNS handled per room rather than isolation switched off across the floor. Separately, the property management system, the door-lock controller and the reception terminal belong on a staff VLAN the guest network has no route to at all — a compromised phone in a room should never see the machine that issues room keys.

A school is a density and filtering problem. Forty devices in one lab need an access point in that lab, not one in the corridor covering three rooms, and the answer is usually per-room placement with transmit power reduced so neighbouring cells stop competing. Student devices, lab machines, the administration and fee-counter network and the CCTV recorder each want their own VLAN, and web filtering has to apply to the student network as a policy rather than as an expectation.

A clinic is a segmentation problem. Diagnostic equipment and the workstations that read images frequently run operating system versions the manufacturer stopped supporting years ago and will not permit you to patch, which is exactly the argument for keeping them on their own VLAN with no path from the waiting room. Waiting-room Wi-Fi should reach the internet and nothing else, and the appointment and billing terminals should never share an SSID with it.

Guests should not be able to take the whole link

Cap the guest network twice. A per-client rate limit stops one device taking everything, and a ceiling on the guest VLAN as a whole stops guests collectively starving the business. A few megabits per client covers browsing and a video call, and that limit is the difference between a visitor streaming comfortably and a card machine timing out.

Then give priority to the traffic that must not fail. Voice and the payment terminal want QoS ahead of bulk downloads and the nightly backup, and that is set on the switch and the firewall rather than hoped for. Bulk peer-to-peer traffic is worth blocking on the guest VLAN outright, since nothing a guest legitimately needs depends on it.

The survey question

Ask for a survey with measurements, not a drawing with circles on it. The circles are drawn to a radius somebody chose in an office. The measurements are taken in your building, through your walls, with the steel shelving and the lift shaft where they actually are.

Two numbers separate a survey from a sales visit. The first is the signal level the design commits to: a phone wants better than roughly -67 dBm to hold a video call, and a design to -80 dBm looks healthy on a heat map and drops calls in the room. The second is the channel plan. At 2.4 GHz there are only three non-overlapping channels in practice, so an SCO block where four neighbours are all broadcasting needs a plan rather than automatic selection, and 5 GHz is usually better set to 40 MHz channels than 80 MHz in a dense fit-out, because narrower channels mean more of them.

The cable feeding each access point matters as much as the access point. It sits in the ceiling, which is the most expensive place to revisit, it has to stay inside the 90-metre installed copper limit, and it has to carry the PoE class the access point actually draws rather than the one the datasheet lists as minimum.

• Access-point positions marked on the floor plan, with mounting heights
• The signal level each area is designed to, stated in dBm
• A channel and transmit-power plan, not placement alone
• The cable run to each access point, its switch port and its PoE draw
• A VLAN and SSID map showing what each network can and cannot reach
• A re-test after installation, in the furnished building rather than the empty one