To give visitors Wi-Fi safely, turn on your router's guest network, use its own name and password, and make sure it blocks access to your local network and to other guest devices. Then test it from a phone: the guest network should reach the internet but not your printer, file server or the router's admin page. A separate network name on its own is not isolation, so the test matters.
Who this is for
This is for owners and office managers who run a small office on one router or access point and want visitors, clients and contractors to use Wi-Fi without touching staff PCs, printers or a NAS. By the end you will have a guest network with its own password, the isolation settings checked, and a test to prove it works. If you have managed switches and want a full design, read VLAN Setup for a Small Office: Separate Guest Wi-Fi and Staff Devices after this.
Why guests should not share the staff network
Anyone on your main Wi-Fi can try to reach other devices on it: shared folders, printers, cameras and the router's admin page. Visitors' phones and laptops may also carry malware you cannot see. A guest network gives them a route to the internet only.
An SSID is simply the network name a device sees and connects to. Creating a second network name is not enough on its own; the equipment has to keep the two networks apart. A flat network where every device shares one subnet and one password is what a segmentation guide from Purple rates as high risk. On a consumer-style router, the "guest network" feature does that for you. On managed equipment, you set it up with VLANs and firewall rules.
Choose your approach
| Your equipment | Approach |
|---|---|
| One router with a built-in guest network feature | Turn on the guest feature and verify isolation settings |
| Router plus separate access points | Check that the access point supports a guest SSID tied to an isolated network; follow the vendor's guide |
| Managed router, switch and access points | Use a guest VLAN with firewall rules, as in the VLAN guide linked above |
If your router has no guest feature, or you cannot confirm that it isolates guests, consider hardware that does.
Set up the guest network on a router
Menus differ by brand, so the steps below follow TP-Link's published guide for its cable modem routers as an example. Check your own router's manual for the same options under similar names.
- Log in to the router's web management page.
- Go to Advanced, then Wireless (2.4G or 5G), then Guest Network. In the Wireless section:
- Turn on the guest network.
- Enter a name that guests can recognise. TP-Link advises hiding the SSID only if guests will type it in manually.
- Set a password that is easy to share.
- Save.
- In the Settings section of the same page, find the two access options:
- Allow guests to see each other lets devices on the guest network communicate with one another.
- Allow guests to access my local network lets guests reach your local network, not just the internet.
- Leave both unticked, then save.
Leaving both options off keeps guests to internet access only. The TP-Link page does not describe bandwidth or time limits and refers to the product manual for these, so check your own model for them.
On other brands, look for terms such as guest network, client isolation, AP isolation, or "internet access only".
Passwords and security mode
Choose a mode
The Wi-Fi Alliance says WPA3-Personal gives increased protection from password-guessing attempts, and that WPA3 networks require Protected Management Frames. Use WPA3-Personal if your router and your regular visitors' devices support it. Many routers also offer a combined WPA2/WPA3 option for older devices; if your guests use old phones or laptops, that may be needed. Read your router's help page for the exact option names; TP-Link's guide for the cable modem models above lists WPA/WPA2 Personal.
Choose the password
- Use a different password from the staff network, and never give guests the staff one.
- Make it long enough to resist guessing but easy to read aloud or print, for example several unrelated words.
- Do not reuse a password from any other account.
Share it without putting it on a notice board
- Give it verbally or on a printed card at reception that you replace when you change it.
- Change it when staff who knew it leave, if you suspect misuse, and on a regular schedule you will keep to. There is no single official interval; pick one you can follow, such as monthly or quarterly.
- Keep the router's admin password strong and different from both Wi-Fi passwords, and change the factory default.
Test that guests are isolated
Do this after setup and after any firmware update.
- Connect a phone to the guest network.
- Open a web page to confirm internet access works.
- In the phone's browser, type the router's admin address (for example the address on the router's label). The admin page should not load from the guest network. If your router allows admin access from guests, find the setting that restricts it.
- Try to reach a staff PC, printer or NAS by its IP address from the guest phone, using a browser for devices with a web page. It should fail.
- If you have two phones, connect both to the guest network and check whether they can see each other. With the "see each other" option off, they should not.
If any test succeeds, recheck the options in the previous section, update the router firmware and look in the manual for a client isolation setting.
Other settings worth checking
- Firmware: keep the router and access points updated from the vendor's official site.
- Remote management: turn off remote administration unless you need it.
- WPS: turn it off if you do not use it.
- Bandwidth fairness: if your router supports it, limit guest speeds so visitors do not slow the office. Settings differ by model.
- Printers and shared devices: if guests need to print, give them a way that does not open your staff network, such as printing from reception.
- Acceptable use: a short printed notice with the guest network rules is sensible. Check legal requirements for logging and visitor access that apply to your business with your adviser, because rules vary.
Troubleshooting
| Problem | What to try |
|---|---|
| Guests connect but have no internet | Confirm the guest network is on the same router as the working internet connection and reboot the router |
| Guests can see staff devices | Turn off the "access my local network" option and any similar setting, update firmware and test again |
| Older devices cannot join | They may not support the security mode you chose; check mixed WPA2/WPA3 options in your router's manual |
| Guest network disappears | Check any schedule or time limit on the guest network and whether the SSID is hidden |
| Phones join the staff network by mistake | Rename the networks clearly, and have staff forget the guest network on their phones |
Checklist
- Guest network on, with its own name and password.
- Both access options (see each other, access local network) off, or the router's equivalent.
- WPA3-Personal if supported, otherwise the strongest mode your devices accept.
- Staff password never shared; guest password changed on a schedule.
- Router admin password changed, remote management off.
- Isolation tested from a phone, and again after updates.
References
- TP-Link, How to set up Guest Network of TP-Link cable modem routers: https://www.omadanetworks.com/de/support/faq/1492/
- Wi-Fi Alliance, Security: https://www.wi-fi.org/discover-wi-fi/security
- Purple, Wi-Fi network segmentation, VLANs, SSIDs and guest traffic (SSID definition and risk rating of flat networks): https://www.purple.ai/en-us/guides/wifi-network-segmentation-vlans-ssids-and-guest-traffic
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.