In brief
The order between modem, switch, access points and the hotspot appliance. Three common layouts and when to choose each.
The first question businesses ask after buying a hotspot appliance is usually: "Where do I plug this in?"
The answer in one sentence: all guest traffic must pass through this device, and staff traffic must not. Several physical layouts achieve that.
The basic rule
To verify sign-ins and keep records, the device has to see guest packets. If a packet can reach the internet while bypassing the device, that traffic is neither verified nor recorded.
The simplest way to test the setup: try to reach the internet from a guest device without signing in. If you can, the setup is incomplete.
Layout 1: the device behind the modem (most common)
Internet → Modem → Hotspot appliance → Switch → Access points → Guests
↓
Staff network
The device sits between the modem and the internal network. Guest and staff networks connect to different legs of the device.
When: single-floor or small installations where you can redo the cabling. It gives the cleanest separation.
Watch out: the modem's own Wi-Fi must be turned off. If it stays on, guests can bypass the device and connect straight to the modem.
Layout 2: separation with VLANs
Internet → Modem → Hotspot appliance → Managed switch
├── VLAN 10: Staff
└── VLAN 20: Guest → Access points
Without changing the physical cabling, the switch separates the networks virtually. Access points broadcast two SSIDs; the guest SSID maps to the guest VLAN.
When: you have a managed switch and VLAN-capable access points. In multi-floor buildings it removes the cabling cost.
Watch out: the access points' management interface should stay on the staff VLAN, unreachable from the guest VLAN.
Layout 3: behind an existing firewall
Internet → Firewall → Hotspot appliance → Guest access points
↓
Staff network
If you have a corporate firewall and do not want to replace it, the hotspot appliance goes on the guest leg only.
When: organisations that have already invested in a firewall and have settled network policy.
Watch out: the firewall needs a separate rule set for the guest leg; guest access to the internal network must be blocked.
DNS: the most commonly missed setting
This is where setups stall most often, and where non-technical teams lose days.
The DNS server handed to the guest network must point at the hotspot appliance. If the modem hands out an external DNS address by default, an unverified guest's operating-system probe cannot resolve and the sign-in page never opens by itself.
Symptom: "I join the Wi-Fi but no sign-in screen appears."
Fix: in the guest network's DHCP settings, set the DNS server to the appliance's address.
Wireless coverage is a separate job
A hotspot appliance does not produce signal. If you have a coverage problem, the answer is at the access points:
- Add an access point where the signal is weak in distant rooms.
- Neighbouring access points on the same channel drown each other; plan channels.
- Wall and suspended-ceiling materials weaken signal far more than you expect.
The appliance solves none of this. If "the Wi-Fi got slower" comes up after installation, look at coverage first.
Post-installation checklist
- Can you reach the internet without signing in? (You should not.)
- Does the sign-in page open by itself? (Test on iPhone, Android and Windows separately.)
- Is the modem's own Wi-Fi off?
- Can guest devices see each other? (They should not.)
- Can the guest network reach the staff network? (It should not.)
- Are fixed devices such as card terminals and printers on the exemption list?
- Has it been tested at the furthest point, at the busiest hour, with a real phone?
Items five and six are the checks most often skipped after installation.