How do I set up a guest wifi network safely?
A guest network must be separated from your business network via its own VLAN, not just a second SSID on the same subnet. Otherwise you are giving visitors access to your internal servers and printers.
Try this first
- 1Create a separate VLAN on your switch and router (e.g. VLAN 30 for guest). Assign its own DHCP pool (e.g. 192.168.30.0/24).
- 2On your AP controller: create a second SSID "[company]-Guest", bind to VLAN 30, enable client isolation so guests cannot see each other.
- 3On your firewall: block all traffic from VLAN 30 to internal VLANs. Allow DNS and outbound internet only. No access to 192.168.0.x or 10.x.x.x.
- 4Captive portal and password: a rotating voucher system works better than a fixed password on the whiteboard. Suppliers and old visitors will know it for months.
- 5Per-guest bandwidth cap: rate-limit so one visitor watching a video does not disrupt your calls. 5-10 Mbit per guest is usually enough.
When to bring us in
With multiple AP brands or a complex firewall (PfSense, OPNsense, FortiGate, Cisco Meraki) this gets fiddly. We set it up correctly from scratch, ask us.
See also
- Wi-Fi drops randomly across the officeFirst rule out whether it is the access points or the internet connection itself. Different fix.
- One room or corner has no or bad Wi-FiNot always "add another AP"; often one is poorly positioned, or there is a metal wall in the way.
- Internet is suddenly slow for everyoneThree suspects: your provider, a colleague soaking the line, or a backup or update kicking in unexpectedly.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.