Guest WiFi for Businesses: How to Offer Access Without Internal Network Risks

Guest WiFi for businesses is more than just a visitor service – if improperly configured, it is one of the biggest security holes in SMB environments. This article explains how to set up a welcoming yet secure office network that provides internet access to visitors while keeping internal systems locked down.

Most Common Mistakes Seen in Practice

• Using the same Wi-Fi for employees and guests ("MyCompany-WiFi" with a password known to everyone).
• Separate SSID, but on the same VLAN as users – guests can see printers, NAS, and parts of the Active Directory.
• No captive portal and no time or bandwidth limits.
• Password remains unchanged for months or years, even after visitors have left the premises.

Proper Architecture: VLAN Segmentation

The foundation is strict traffic isolation on the firewall using VLAN segmentation. Recommended minimum setup:

On the firewall (pfSense, OPNsense, FortiGate, Sophos), set the rules: only traffic to the internet is allowed from the Guest VLAN; everything else is rejected.

Captive Portal: Login, Notification, and Logging

A captive portal is the page a visitor sees before accessing the internet. Purpose:

• Acceptance of terms of use (legal protection for the company).
• Name and email entry (optional, for marketing).
• Session time limits (e.g., 8 hours).
• Logging access for potential legal proceedings.

Captive portals are built into UniFi, pfSense, Aruba Instant On, and Meraki – no separate license required.

Recommended Policies

1. Bandwidth: Limited to 5–10 Mbit/s per device so guests don't consume the entire line.
2. Rate limiting: Maximum 30 concurrent devices (for smaller offices).
3. Blocking P2P and torrent traffic.
4. DNS filter (e.g., Cloudflare Family, Quad9): Blocks malware and inappropriate content.
5. Password rotation automatically every month, or WPA3 with SAE (more secure than a shared password).

WPA3 and Separate Passwords: The End of the "Shared Password" Era

New access points (UniFi U6, Aruba, Cisco) support WPA3-SAE Personal, which gives each client a unique encryption key even with the same password. This means even if an attacker knows the password, they cannot eavesdrop on other devices' traffic.

Let's Set Up Secure Business WiFiWe plan VLANs, set up access points and captive portals, and ensure legal compliance.

Handling GDPR with Captive Portals

If you collect email addresses or names via the captive portal, this constitutes personal data processing. You need: (1) a clear legal basis (consent), (2) entry in the records of processing activities, (3) a retention period (we recommend 30–90 days for logs, emails only if you have a defined purpose for use).

Do I need a separate access point for guests?

No. Modern APs (UniFi, Aruba, Meraki) allow multiple SSIDs on a single device, where each SSID can be mapped to its own VLAN. A single AP can therefore easily serve employees and guests separately.

Can guests see each other on the network?

If you enable 'Client Isolation' on the SSID, no. This is the recommended setting for guest networks.

What speed should be provided to guests?

We recommend 5–10 Mbit/s per device – enough for video calls and browsing, not enough for HD streaming by a large crowd. Adjust based on your internet line speed.

Do I need a special license for the captive portal?

It is included by default in open-source solutions (pfSense, OPNsense) and UniFi. Meraki and some Cisco products require a license.

How much does the setup cost for a small office?

If you have a managed switch and a modern AP, setting up VLANs and a captive portal takes about 8–12 hours of consulting work. If the infrastructure is outdated, equipment costs are added.