In brief
A described diagram for splitting a small business network into four VLANs: what each carries, where the box sits, POS and printer exemptions, and why cameras stay separate.
Network design for a cafe, a shop or a small hotel starts with four questions: where do guests connect, where does the till connect, where do the cameras connect, where does staff connect? If you give the same answer to all four ("everything into the modem"), you are making the most common mistake. This post describes a simple four-VLAN layout in words instead of a drawing; you can sketch it yourself.
Read the diagram in words
Picture four layers from top to bottom.
At the top, the modem/router. The only device that reaches the internet. If you have fibre with a 4.5G backup line, the failover also lives here. One router port goes to the switch, one to the WAN side of the Hotspot-Box.
Below it, a managed switch. The backbone that carries the VLANs. Its ports are spread like this: the box's LAN side (guest VLAN), the APs (tagged with guest and staff VLANs), the till and POS devices (POS VLAN), the camera recorder and cameras (camera VLAN), staff PCs and the printer (staff VLAN).
To the side, the Hotspot-Box. Its WAN connects to the router, its LAN to the guest VLAN on the switch. It is the single exit door of the guest VLAN: it assigns IPs, shows the portal, applies speed and quota, and collects the internal IP assignment records. The other three VLANs never touch the box; they exit through the router.
At the bottom, the APs. They broadcast two SSIDs: the guest SSID tagged with the guest VLAN, the staff SSID tagged with the staff VLAN. Client isolation is on for the guest SSID.
The four-VLAN table
| VLAN | Carries | Exits via | Portal? | Can reach |
|---|---|---|---|---|
| Guest | Guest phones, guest TV, menu tablet | The box | Yes (except exempted devices) | Internet only |
| POS | Till, payment terminal, receipt printer | The router | No | Payment provider and required internal server |
| Camera | IP cameras, recorder (NVR) | The router (if remote viewing is needed) | No | Only the NVR and authorised staff devices |
| Staff | Office PCs, printer, staff phones | The router | No | Staff resources, optionally the NVR |
You choose the VLAN IDs (10, 20, 30, 40, say); what matters is that every switch port and every SSID carries the right tag.
Exemptions on the guest side
Some devices on the guest VLAN cannot pass a portal: the smart TV on the wall, the printer guests use, the waiters' order tablet. For those you define a MAC exemption on the box. The device goes online without verifying, but it stays on the guest VLAN and cannot reach the staff or POS network.
Two POS situations come up:
- Till and fixed payment terminal: these belong on the POS VLAN. There is no reason to put them on the guest network.
- A mobile payment device that only knows Wi-Fi and one SSID: the ideal fix is a POS SSID. The temporary fix is to join it to the guest SSID with a MAC exemption. That only skips the portal; the device stays subject to the guest speed plan and client isolation. Payment traffic is encrypted, so it works, but do not make this the permanent design.
Why cameras never join the guest VLAN
This rule is not negotiable. The reasons:
- Camera web interfaces are weak. Most run on factory passwords and never get updated. A camera on the same network as guests can be opened in a guest's browser.
- Records get muddled. The box keeps an internal IP assignment record for every device on the guest VLAN. A camera is not a guest; having it in the records is unnecessary and confusing when records are reviewed.
- Bandwidth. Cameras upload constantly. The guest plan's speed limit would choke them; without a limit, they would eat guest bandwidth.
- They need isolation. A camera should talk only to the recorder and to authorised staff PCs. That is easiest to guarantee with a router rule on its own VLAN.
If remote viewing is needed, the camera VLAN exits through the router, and the router opens only as much as the recorder requires.
What the box does and does not do
The box is the firewall and the record keeper of the guest VLAN. Traffic between the POS, camera and staff VLANs is managed by the router (or your corporate firewall, if you have one). The box does not replace a UTM; your internal network security is planned separately. That limitation is exactly the box's strength: it cuts the guest network off from the rest of the business and keeps the records of the network it cut off.
If there is no managed switch
A small cafe may not have a managed switch. Then you separate physically instead of with VLANs: one cable from the box's LAN port going only to the guest AP; the till, camera recorder and staff PC on the router's own ports. Instead of four VLANs you get two physical networks: guests (behind the box) and everything else (behind the router). Cameras sharing a network with the till is not ideal, but guests still stay outside. When the business grows, add a managed switch and move to the layout in this post; the box's position does not change.
Installation order
- Define the four VLANs on the switch and assign the ports.
- On the router, set up gateways for the POS, camera and staff VLANs and write the inter-VLAN rules.
- Connect the box: WAN to the router, LAN to the guest VLAN.
- Tag the two SSIDs on the APs and enable client isolation on the guest SSID.
- Enter MAC exemptions for the guest TV and tablets.
- Run the three-step test with a guest phone: ping the staff gateway, scan, try the printer.
See the industry guides for plan templates and sample layouts by sector, and the box page for the box's technical details. If you would rather run it on a hypervisor, the same software ships as a virtual appliance.
This is a technical guide, not legal advice.