Offering visitors Wi-Fi is a small, welcome courtesy. Done carelessly, it is also a quiet back door into your business. A surprising number of “guest” networks are really just your main network with a friendlier name, which means the person on the sofa in reception is sitting on the same network as your tills, cameras and files. Here are the settings worth checking.
1. Keep guests separate from your business
This is the big one. Your guest network should be walled off from your staff systems entirely, so a visitor, or malware on their laptop, can reach the internet and nothing else. The proper way to do this is to put guests on their own VLAN, a separate lane with no route into the rest of your network. If your guest Wi-Fi shares the same network as your office, that is the first thing to fix.
2. Turn on client isolation
Client isolation stops guests from seeing one another’s devices. Without it, everyone on the guest Wi-Fi is on a shared network with strangers, which is exactly how a nasty device on one laptop can go looking for others. With it on, each guest can reach the internet but not the person at the next table.
3. Hide your internal devices
Make sure printers, servers, network storage, cameras and payment kit are simply not reachable from the guest network. Guests should have no way to find, let alone print to, log in to or poke at, anything that belongs to the business. If a visitor can see your office printer, the separation is not tight enough.
4. Use a password, and manage it
Even a guest network benefits from a password, and it should never be the same one your staff use. A shared code that you can change easily, or a rotating one, keeps casual freeloaders off and gives you a little control. The point is not secrecy so much as a sensible gate.
5. Add a captive portal
A captive portal is the little welcome page guests see before they get online. It lets you show a short acceptable-use notice, brand the experience, and set expectations, and it gives you a basic record that guests agreed to your terms. Keep it light and privacy-respecting: a clean landing page does the job without hoovering up personal data.
6. Cap the bandwidth
Without a limit, a couple of guests streaming films can starve the business that is paying the bill. Set a sensible ceiling on guest usage, per device or overall, and make sure your business traffic takes priority. Visitors get a decent experience; your card machines and calls never suffer for it.
7. Cover the basics
- Keep firmware updated on whatever runs the guest network, so known holes are closed.
- Do not expose management. The admin login for your kit should never be reachable from the guest side.
- Remember it is your connection. You have a degree of responsibility for what happens on it, so isolation, a portal with acceptable-use terms and basic filtering are all sensible protection.
The 60-second audit. Is guest Wi-Fi on its own separate lane? Is client isolation on? Can a guest see your printer, cameras or tills? Is there a password you can change? Is there a bandwidth cap? If any answer is “not sure”, it is worth a proper look.
How Synergy Max helps
We set guest Wi-Fi up the right way as part of your network: a fully separate lane, client isolation on, your internal kit invisible to visitors, a tidy captive portal and sensible limits, so guests get a smooth connection and your business stays firmly out of reach. It is the same thinking behind our approach to busy, shared spaces in our guide to high-density Wi-Fi.