The UniFi Dream Machine is a superb gateway for hotels, guest houses and HMOs. It routes, firewalls, runs the Wi-Fi controller and can give every room or tenant their own private network from a single wireless name. It is also very easy to set up in a way that looks finished and is not. We are regularly asked to look at Dream Machine installs where residents can see each other’s devices, the CCTV is on the guest Wi-Fi, or a tenant who plugs into the wall lands on the management network. Here is how to set one up properly, and the mistakes we fix most often.
The 30-second version
- A VLAN on its own is not a wall. UniFi lets internal networks talk to each other unless you tell it otherwise.
- PPSK gives each room or tenant their own password, and each password can put them on their own network, all on one Wi-Fi name.
- Client isolation alone breaks casting, because a resident cannot reach their own TV. Per-tenant networks solve it.
- Wall ports, DHCP pools and the owner’s own kit are where most multi-occupancy setups quietly leak.
- We are certified on Ubiquiti UniFi and set these up across Merseyside and the North West.
On this page
- Why hotels and HMOs are a different job
- The setup, in the right order
- Pitfall: creating VLANs and assuming they are separate
- Pitfall: one guest network, and nobody can cast to their own TV
- Pitfall: misunderstanding what PPSK actually does
- Pitfall: wall ports that drop tenants onto your management network
- Pitfall: running out of addresses on a busy Saturday
- Pitfall: the owner’s systems sitting on the guest network
- Pitfall: one resident using the whole connection
- Where these setups go wrong most often
- Frequently asked questions
Why hotels and HMOs are a different job
An office network serves one organisation whose staff are all meant to work together. A hotel, guest house, serviced apartment block or house in multiple occupation is the opposite. Dozens of unrelated people share one building’s network, each of whom expects privacy, and none of whom should be able to see the owner’s systems.
- Residents must not see each other. A guest’s laptop, phone and smart speaker should be invisible to the room next door.
- Residents still need their own devices to work together. A tenant expects to cast from their phone to their own TV.
- The owner’s systems must be out of reach. CCTV, door entry, tills, booking systems and heating controls do not belong on a residents’ network.
- People come and go constantly. Guests check out and tenants move on, and their access needs to go with them.
The Dream Machine can do all of that. It just does not do it by default.
The setup, in the right order
Most problems come from building the network first and thinking about separation afterwards. This is the order we work in:
- Take the ISP router out of the way. If the broadband provider’s router is still routing, you have two routers in a row, known as double NAT. It causes problems with VPNs, port forwarding and some phone systems. Put it into modem or bridge mode where the provider allows it, so the Dream Machine is the only router.
- Secure the owner account. Set up the Dream Machine under a business account with two-factor authentication. Give staff and contractors their own logins with limited roles, rather than sharing the owner password.
- Update, then schedule updates. Bring the firmware up to date before configuring anything, then choose when future updates happen, rather than finding out on a busy morning.
- Plan the networks on paper. Decide what each network is for and who can reach what, before creating anything.
- Create the networks, then the rules between them. Separation comes from firewall rules and isolation settings, not from the VLAN alone.
- Set the switch ports. Access point uplinks, cameras, tills and in-room wall ports each need the right port profile.
- Keep the Wi-Fi names few. Use PPSK rather than a separate wireless network for every group.
- Turn on backups, so a failed device or a mistaken change can be undone in minutes.
A typical plan for a small hotel or HMO looks like this:
| Network | What lives on it | Can reach |
|---|---|---|
| Management | The Dream Machine, switches and access points | Only administrators |
| Business | Reception PCs, booking system, tills | The internet, printers, management for admins |
| Security and building | CCTV, door entry, heating and alarm panels | Only what each device needs |
| Residents | Guests or tenants, ideally one network per room or tenant | The internet only |
Pitfall: creating VLANs and assuming they are separate
This is the most common mistake we find. Someone creates a guest VLAN, a staff VLAN and a CCTV VLAN, sees them listed neatly in the dashboard, and assumes the job is done.
It is not. A VLAN keeps traffic apart on the cabling, but the Dream Machine is the router between them, and by default UniFi routes between its internal networks. In recent versions of UniFi Network, which use a zone-based firewall, networks in the same internal zone can reach each other unless you add rules or move them into separate zones. So a guest can often still reach the CCTV recorder, even though the two are on different VLANs.
The fix is to decide the separation deliberately. Put resident networks in their own zone or mark them as isolated, block traffic from resident networks to everything internal, and then test it from a device on the guest network. If you have not tried to reach the NVR from a guest phone, you do not know whether you can.
Pitfall: one guest network, and nobody can cast to their own TV
The quick way to stop residents seeing each other is to put everyone on one guest network and turn on client device isolation, so no device can talk to any other. It works, and for a simple hotel lobby network it is often right.
For longer stays and HMOs it creates a new complaint. Isolation cannot tell the difference between a stranger’s laptop and the tenant’s own TV. So the tenant cannot cast from their phone, their wireless printer vanishes, and their smart speaker will not pair.
The better design is a separate network for each room or tenant. Each tenant’s devices sit together on their own network and can see each other, while firewall rules keep every tenant network apart from the others. The question is how to do that without broadcasting fifty Wi-Fi names, and that is exactly what PPSK is for.
Pitfall: misunderstanding what PPSK actually does
PPSK stands for private pre-shared key. Instead of one password for a wireless network, you create many, and UniFi can put each password onto a different network. Room 4 connects to the same Wi-Fi name as room 5, but with its own password, and lands on its own private network. One wireless name, many private networks behind it.
It is the right tool for hotels and HMOs, and it is regularly set up in a way that undermines it:
- It relies on WPA2. PPSK works with WPA2 security. Switch the wireless network to WPA3 and the private keys are no longer available, so check before “upgrading” the security setting.
- A key is a password, not an identity. Anyone who is given room 4’s key is on room 4’s network. When a tenant moves out, change their key, or their devices keep connecting.
- Two keys on one network are not separated. If several keys point to the same network, those residents can see each other. The privacy comes from the network each key maps to, not from the key itself.
- Separate networks still need rules. PPSK puts each tenant on their own VLAN; the firewall is still what stops those VLANs reaching each other.
Fewer Wi-Fi names, better Wi-Fi
Every wireless network name an access point broadcasts uses up airtime, even when nobody is connected to it. Replacing a dozen per-room Wi-Fi names with one name and PPSK does not just look tidier, it measurably frees up capacity in a busy building.
Pitfall: wall ports that drop tenants onto your management network
This one is easy to miss and serious when it happens. Many HMOs and hotels have ethernet sockets in the rooms. On a UniFi switch, a port left on its default profile gives any device plugged into it the default network, which is usually the management network, where the Dream Machine, switches and access points live.
So a tenant plugs a laptop or games console into the wall, and it lands next to your network equipment rather than on their own network. Every in-room port should be set to that room’s network, with no other networks allowed through it.
The reverse mistake catches out access points. An access point needs its uplink port to carry the management network untagged and the resident networks tagged. Change that port to a single resident network and the access point loses contact with the Dream Machine and drops off the dashboard.
Pitfall: running out of addresses on a busy Saturday
A guest network is usually created with room for around 250 devices and addresses handed out for a day at a time. In a hotel that sounds generous, until you count phones, laptops, tablets and watches, then add every guest who stayed yesterday and whose address is still reserved.
When the pool runs out, new arrivals connect to the Wi-Fi and get no internet, and it looks like a Wi-Fi fault. On a busy guest network, make the address range bigger and the lease time shorter, so addresses are recycled as people leave.
Pitfall: the owner’s systems sitting on the guest network
Smart heating controllers, CCTV recorders, door entry panels and card machines often end up on the guest Wi-Fi, because that was the password to hand on the day they were installed. It works, so nobody moves them.
It also puts the building’s security systems on the same network as every resident. Move them onto a dedicated security and building network, block residents from reaching it, and give the few people who need access to the cameras a way in that does not involve the guest Wi-Fi.
Pitfall: one resident using the whole connection
In a shared building, one person streaming in 4K on three devices or downloading a large game can make the connection feel slow for everyone. Without limits, the busiest resident wins.
UniFi lets you set speed limits per network or per device. For HMOs where broadband is included in the rent, a sensible per-tenant limit keeps things fair without anyone noticing it on a normal evening. If residents regularly hit the limits, that is the sign the connection itself needs upgrading, whether to full fibre or a leased line.
For more general UniFi faults, including throughput capped by security features, devices sticking to distant access points and casting across networks, see our guide to common Ubiquiti UniFi problems.
Where these setups go wrong most often
Ranked by how often we find each one when we are asked to look at an existing hotel or HMO network:
| What we find | How often we see it | What it causes |
|---|---|---|
| VLANs created but not firewalled | Very common | Residents can reach CCTV, tills or each other |
| Building systems on the guest Wi-Fi | Very common | Security kit exposed to every resident |
| Isolation instead of per-tenant networks | Common | Tenants cannot cast or print to their own devices |
| In-room ports left on the default network | Common | Wired devices land on the management network |
| PPSK keys never changed | Common | Former tenants still connecting |
| DHCP pool too small | Occasional | New guests connect but get no internet |
| ISP router still routing | Occasional | VPN, port forwarding and some calls fail |
Running a hotel, guest house or HMO?
We design, install and manage UniFi networks for multi-occupancy buildings, with private networks per room or tenant, the owner’s systems kept separate, and someone to call when a resident cannot connect.