Guest Wi‑Fi: how to secure it

This article was machine-translated from French and is being reviewed. Prices are in Algerian dinars excl. VAT.

A guest Wi‑Fi lets your visitors (clients, contractors) access the Internet without reaching your internal network. To make this true, you need real separation: a separate Wi‑Fi SSID linked to its own VLAN and subnet, plus firewall rules that block all access to the internal network. Without this, a “guest network” is just another Wi‑Fi name on the same network. Here’s how to set it up.

Why isolate guest Wi‑Fi?

Without isolation, guests’ devices are on the same network as yours. A guest can then:

• See the printers, servers and recorders on your network.
• Attempt to connect to them, which succeeds if a password is weak or a service is out of date.
• Introduce an infected device next to your workstations.
• Consume all bandwidth with downloads or streaming.

With a separate SSID and VLAN and proper rules, the guest only has Internet access. This does not protect the guest’s device itself, but it prevents that device from reaching your resources.

Architecture of a secure guest Wi‑Fi

`` Internet | Firewall: one gateway address per VLAN | trunk 802.1Q (VLAN 10, 20, 30, 40) Managed switch |-- access ports: workstations (VLAN 10), server (VLAN 20), cameras (VLAN 30) '-- trunk: Wi‑Fi access point SSID “MaSociete” -> VLAN 10 (internal network) SSID “MaSociete-Invites” -> VLAN 40 (guests) ``

The access point broadcasts two SSIDs, each linked to its VLAN. Each SSID has its own password and subnet. The full addressing plan is detailed in VLAN: segment your network.

Step‑by‑step configuration

Step 1: check the equipment

• The terminal must handle multiple SSIDs and associate each with a VLAN. Many consumer Wi‑Fi routers only offer an isolated “guest network” option, without VLANs or fine tuning. This may suffice for a very small premises, but not for an SME that has a server or cameras.
• The switch must be manageable and provide a trunk port to the terminal. The firewall must handle VLANs and set rules per VLAN.
• If the access point supports only one SSID, add a second guest‑dedicated AP connected to an access port on VLAN 40.
• For the number of access points, see how many Wi‑Fi access points to plan. An access point is wired to the network and often powered via PoE: see Cat6 or Cat6A and the price of an RJ45 point.

Step 2: create the guest VLAN

1. Create VLAN 40.
2. Assign it a subnet, e.g. 192.168.40.0/24, with gateway 192.168.40.1 managed by the firewall.
3. Enable a DHCP server on the firewall for this VLAN. It distributes address, gateway and DNS: the firewall’s DNS or a public resolver, never an internal DNS server.
4. Configure the AP port as trunk, with VLAN 40 tagged.

Step 3: configure the guest SSID

On the AP, create an SSID:

• Name : distinct and explicit, e.g., “MaSociete-Invites”.
• Security : WPA3-Personal (SAE) if guest devices support it, otherwise mixed mode WPA2/WPA3 or WPA2-Personal with AES encryption. Do not use WEP or WPA with TKIP. WPA3 is mandatory for Wi‑Fi certified devices since July 2020; many older devices only support WPA2.
• No password : the Enhanced Open (OWE) mode encrypts each client separately without a password, if the access point and devices support it. An open SSID without OWE is not encrypted: avoid it.
• Password : at least 12 characters (WPA2 and WPA3 accept 8 to 63 characters). Change it when it has left the intended scope.
• Client isolation (client isolation): enabled. Two guests no longer see each other.
• Bands : 2.4 GHz and 5 GHz, depending on the devices to serve.

Step 4: write firewall rules

Two types of traffic must be controlled: traffic crossing the firewall (from VLAN 40 to other networks) and traffic destined for it (administration, DNS, DHCP). Rules are evaluated in order.

These rules are applied on the firewall, e.g. a MikroTik or Fortinet FortiGate, the two brands we supply and install. The responses to allowed connections come from them (stateful firewall). Do not allow only ports 80 and 443: without DNS nothing works, and many applications (instant messaging, video conferencing) use other ports. Rule 2 is often forgotten: blocking traffic to other VLANs does not protect the firewall’s own admin interface. Rule 4 stops an infected device from being a spam relay.

Step 5: limit bandwidth

Limit the guest VLAN’s bandwidth with a global ceiling and, if equipment allows, a per-client ceiling. The global ceiling counts the most: it guarantees a share of the line for your teams. Example, adapt as needed: on a 20 Mb/s line, a global ceiling of 5 Mb/s for guests leaves 20 − 5 = 15 Mb/s for other networks, even if several guests download simultaneously. The per-client ceiling then distributes those 5 Mb/s among them. First measure your line’s real bandwidth: that determines the values.

Step 6: captive portal (optional)

A captive portal is a web page shown on first connection. The guest accepts terms of use or enters a code or ticket. Before validation, only traffic needed for the portal (DHCP, DNS, portal page) is allowed.

Advantages

• A ticket or code can have a limited duration, without changing the Wi‑Fi password.
• You display terms of use.
• You have a connection log.

Limitations

• A captive portal does not encrypt Wi‑Fi: pair it with a WPA2/WPA3 password or OWE, and test this setup on your devices.
• You need equipment that offers it: e.g. RouterOS Hotspot (MikroTik), pfSense or OPNsense captive portal, or a Wi‑Fi access point with integrated portal. A RADIUS server is only useful for managing named accounts in an external directory.
• If the portal collects e‑mails or phone numbers, or if you keep connection logs, these are personal data covered by law no. 18‑07: collect the minimum and protect them. AsloTech can help you prepare procedures with ANPDP; this support is not legal advice.

Common problems and solutions

The portal page does not display

Phones detect a captive portal by testing an HTTP address. If DNS is blocked before connection, detection fails. If the guest types a direct HTTPS address, the browser cannot be redirected. Allow DNS before connection, verify that the portal has a valid certificate if served over HTTPS, and advise opening a simple HTTP address.

Guests connect to the wrong Wi‑Fi

It’s a human risk. Give clear names and display a QR code that contains the guest Wi‑Fi name and password. Don’t hide the SSID: it adds no security and confuses some devices.

Too many clients slow down Wi‑Fi

A hotspot has limited capacity, depending on the model, band used and usage. If guest Wi‑Fi is often used by many people, add a hotspot rather than lower limits: see how many Wi‑Fi hotspots to plan.

Guests don’t see the printer

That’s the purpose of isolation. To let a visitor print, use another method (email file transfer, for example) instead of opening the internal network.

Change the password

Modify it in the hotspot or Wi‑Fi controller admin interface, then update the QR code and display. Keep the hotspot firmware up to date: a maintenance contract helps you remember.

Security versus convenience

A secure guest Wi‑Fi requires a balance:

• Too strict: unreadable password, complicated portal, too low bandwidth. Guests give up.
• Too permissive: short password, unlimited bandwidth, no isolation. Risks return.

Our recommendation for an SME:

• A distinct SSID, with a password of at least 12 characters, or OWE, or a captive portal.
• An isolated VLAN, with rules that block the internal network and firewall administration.
• A global bandwidth cap for the guest VLAN.
• Client isolation enabled.
• The equipment (firewall, switch, access point) powered by a UPS so Wi‑Fi survives micro‑outages.

Next steps

Check our page network security and firewall to study your current Wi‑Fi setup, and our page IT networks for cabling and access points. You can also read how to segment your network with VLANs to implement isolation, or how to connect sites via VPN if your teams work remotely. For housing the equipment, see network rack.

Frequently asked questions

Also read