Guest Wi-Fi for business: how to set it up properly

Your customers ask for the Wi-Fi password almost before they sit down. In many businesses, the password they get is the same one used by the computers, the till and the cameras. Proper guest Wi-Fi for a business solves this: guests get fast internet and nothing else.

In this guide we explain why the guest network must be separate, how VLAN isolation works, what a captive portal is, how to set bandwidth limits, what GDPR means if you collect emails, what changes in hotels, cafés and clinics, and how to set it all up on UniFi and Omada.

Why guest Wi-Fi must be separate

Anyone on the same network as your computers can, in theory, 'see' them. No bad intent is needed: a phone with malware is enough.

• Security: guest devices must not reach computers, printers, NAS units, point-of-sale systems (POS) or cameras.
• Performance: without limits, one guest downloading large files can slow down card payments or staff video calls.
• Password control: the guest password can change as often as you like without reconfiguring any business device.
• Image: a network with the business name and a clean sign-in page looks professional.

VLAN isolation: the foundation

A second network name (SSID) is not enough on its own. If the guest SSID lands on the same network as everything else, the isolation is in name only. A proper setup has three layers:

1. A separate VLAN: the guest SSID maps to its own VLAN, with its own IP range and its own DHCP.
2. Firewall rules: guests get internet access only. Access to all internal networks and to the router's management page is blocked, and only DHCP and DNS are allowed.
3. Client isolation: guest devices cannot see each other, even within the same network.

For the VLAN to work, everything along the path must support it: access points, switches and the router or firewall. Home routers with a 'guest' feature do something similar, but usually with limited control and no way to extend it across several access points.

After setup, connect a phone to the guest Wi-Fi and try to open the address of the router, a printer or a camera. If anything internal opens, the isolation is not right.

Password, captive portal or open network?

There are several ways for guests to connect. The choice depends on the premises and how much control you want.

• WPA2/WPA3 password: simple and familiar. Change the password regularly and share it with a QR code on the table or at reception.
• Captive portal: a page shown before access is granted. It can ask guests to accept terms of use, enter a password or voucher, or give contact details.
• Vouchers: unique codes with a time or data limit, useful in hotels, training venues and events.
• Encrypted open network (Enhanced Open / OWE): no password, but each device's traffic is encrypted. Newer devices support it, so it is often enabled alongside a compatibility mode for older ones.

We do not recommend a fully open network with no encryption and no terms of use. Traffic is visible to anyone nearby and you have no control over how it is used.

Bandwidth and time limits

Limits are not stinginess, they protect your own connection. The key settings:

• Per-device limit: for typical use, meaning browsing, social media and streaming, a few Mbps per device is enough. The exact figure depends on your line and the number of guests.
• An overall cap for the whole guest network: e.g. a share of the line, so there is always room for the business.
• Priority (QoS): POS, phone and video-call traffic goes ahead of guest traffic.
• Time limits: sessions expiring after a few hours on the captive portal, or set operating hours for the guest network.

If you have two internet lines, e.g. fibre plus Starlink as a backup, you can route guests over one and the business over the other, or switch the guest network off while the backup line is in use.

GDPR: if you collect emails or guest details

Many businesses use the captive portal to collect emails for newsletters. That is processing of personal data, so GDPR applies. We are not lawyers: what follows are general principles, and for your own case ask your legal adviser or check the guidance of the Hellenic Data Protection Authority (dpa.gr).

• Transparency: the sign-in page needs clear text on what data is collected, for what purpose, for how long and how people can exercise their rights.
• Separate consent for marketing: the box for promotional messages must not be pre-ticked.
• As a rule, Wi-Fi access should not depend on consenting to marketing. Offer a way to connect without signing up.
• Minimisation: ask only for what you genuinely need. If you will not send a newsletter, do not ask for an email.
• Retention: decide how long you keep the details and the connection logs. Device MAC addresses also count as personal data.
• Platform provider: if the portal is hosted in a third party's cloud, you need a data processing agreement with them.

The simplest scenario is a portal with just terms acceptance or a password, collecting no data. If collecting emails is your goal, design it from the start with your legal adviser.

Guest Wi-Fi for business by sector: hotels, cafés, clinics

The core principles are the same, but every type of premises has its own needs.

• Hotels and guesthouses: coverage in rooms, common areas and outdoors, many devices per guest, smooth roaming. Vouchers or a password per booking, and per-device limits so one room cannot 'eat' the line. Separate VLANs for staff, reception, cameras and electronic locks.
• Cafés, restaurants and bars: quick sign-in by QR code, a password that changes regularly, per-device and time limits. POS, ordering terminals and kitchen printers on their own VLAN, with priority.
• Clinics and medical practices: strict isolation, because the internal network holds health data. Medical devices and computers on different VLANs from patients in the waiting room. A simple portal with terms of use, collecting no unnecessary data.
• Offices: a guest network for clients and partners in meeting rooms, with a password that changes monthly or day vouchers.

Setting it up on Ubiquiti UniFi

On UniFi, configuration is done centrally in the UniFi Network application. Menu names change between versions, but the steps stay the same:

1. Create a new virtual network with its own VLAN ID and IP range, and enable network isolation so it cannot talk to the others.
2. Create a new Wi-Fi network for guests, attached to that network, and enable client device isolation.
3. If you want a sign-in page, enable the Hotspot portal and choose a method: terms acceptance, password or vouchers. Customise the page with your logo and privacy notice.
4. Set a per-device bandwidth limit for the guest network.
5. Check the firewall rules so there is no access to UniFi device management or to internal networks.
6. Test from a phone: internet yes, internal devices no.

Setting it up on TP-Link Omada

On Omada the logic is similar, from the Omada Controller or the cloud platform:

1. Create a new LAN network with its own VLAN ID and DHCP.
2. Create an SSID for guests, assign it to the VLAN and enable the Guest Network option, which blocks access to private networks and isolates clients.
3. Enable a Portal in the authentication settings, with a simple password, vouchers or a terms-acceptance page.
4. Set rate limits per SSID or per client.
5. If the network has an Omada gateway, add ACL rules to be certain the guest VLAN cannot reach the others.
6. Run the phone test, just as with UniFi.

The same can be done on MikroTik or on other vendors' firewalls. What matters is not the brand, but that all three layers of isolation are in place and verified in practice.

Common guest Wi-Fi mistakes

• The same password for years, printed on a sign photographed by hundreds of people.
• A guest network running through a cheap repeater or a second router plugged into the internal network, with no isolation at all.
• No bandwidth limits, so the POS freezes at peak times.
• A captive portal asking for email and phone number with no privacy notice and no way to decline.
• No testing after setup: isolation is assumed, but nobody has checked it.

How we help

CyberSpace Dynamics sets up guest Wi-Fi for businesses across Attica: access point design, VLANs and firewall, a captive portal with your logo, bandwidth limits and a check that the isolation actually works. If your existing equipment does not support VLANs, we propose the most sensible upgrade.

On GDPR we do not give legal advice, but we implement technically whatever you decide with your legal adviser. Book a free site survey or send us photos of your equipment for a first estimate.