Guest Wi-Fi done safely: isolation, captive portals and bandwidth.

Guest Wi-Fi is one of the easiest ways to put your network at risk, and one of the easiest to do properly.

Isolation first

Guests should reach the internet and nothing else. Use a separate VLAN and firewall policy, with client isolation so guests cannot see each other. Never share the corporate password.

Access method

Options range from an open network with a click-through page to vouchers, one-time passwords by SMS, or sponsor approval by a staff member. Choose the method that matches your privacy and security needs.

Bandwidth and fairness

Cap bandwidth per user so one person streaming video does not slow everyone. Use a separate internet link for guests in busy venues, so they cannot affect business traffic.

Content and logging

Apply sensible web filtering. Keep access logs for the period your policies require, and be clear about what you record. Present terms of use at login.

Sizing

Plan for peak concurrent devices, not headcount. Lobbies, conference halls and restaurants need high-density design.

Branding and analytics

A branded login page and simple usage statistics help hospitality and retail, with consent.

Review

Check the guest network regularly: stale vouchers, unexpected access, and whether the isolation rules still hold after any network change.