In brief
The guest network on home and office routers separates traffic but keeps no identity-bound, signed records. What it gives, what it lacks, and how the box fits alongside it.
Almost every router has a "guest network" switch in its settings. Flip it, a second Wi-Fi name appears, guests join it and cannot see your internal network. Is that enough for a business? The short answer: yes for separating traffic, no for keeping the records expected of a public access provider. The long answer follows.
What a guest network gives you
The router's guest network feature is genuinely useful and there is no reason to turn it off. It usually provides:
- A separate SSID: guests never learn the main network's password.
- Isolation from the internal network: guest devices cannot reach the printer, file shares or cameras (this varies by model; test it).
- A simple speed cap: some models put a total bandwidth limit on the guest network.
- A password or a schedule: one shared password; on some models, switching off at set hours.
For a home or a small office that is plenty for guest Wi-Fi. The problem is the role a business takes on when it offers internet to the public.
What a guest network does not give you
Law 5651 expects a public access provider (anyone offering internet in a publicly accessible place) to keep internal IP assignment records, protect their integrity and retain them for a set period. A router's guest network answers none of those expectations:
| Expectation | Router guest network | Hotspot-Box |
|---|---|---|
| Verifying who the guest is | None; one shared password for everyone | Verification by SMS code, coupon or e-mail |
| Device–internal IP–time record | A transient DHCP table, wiped on reboot | Daily internal IP assignment records kept on the box |
| Record linked to verification details | None | Every session is tied to its verification detail (phone number encrypted and masked) |
| Integrity | None; a plain-text log anyone can edit | SHA-256 hash chain |
| Independent proof of time | None | RFC 3161 timestamp for each day |
| Retention | Hours or days, then overwritten | 2 years; expired days deleted automatically, deletion written to the audit trail |
| Verification and export | None | One-click verification and ZIP export from the panel |
| Speed, duration, quota, device count | A total cap, maybe | A plan per guest |
| Privacy notice and consent record | None | Shown on the portal, consent recorded |
The essence of the table: the router leaves guests anonymous. A hundred people on one shared password are a hundred devices in the router's eyes; nobody knows who is who. Whatever log exists is unsigned, unstamped and short-lived.
"But if something happens, we'll check the modem logs"
Modem logs are usually a list of devices connected right now. There is no way to query the past. Even if there were, the entry says "this MAC got this IP"; it does not say who was behind the MAC and cannot prove the entry was not altered afterwards. Those are exactly the two things expected of a public access provider: a link to a person, and integrity.
Whether your business counts as a public access provider and which obligations fall on you is a legal question; seek legal advice for your situation. The box does the same thing either way: it verifies the guest, keeps the record, signs it and retains it.
How the box sits next to the router
The box does not replace the router; the router stays as the device that reaches the internet. The layout:
- A cable runs from the router to the box's WAN side.
- The box's LAN side becomes the exit door of the guest network: the guest SSID is broadcast by an access point connected to that side, or from the guest VLAN on the switch.
- A guest's phone joins, the portal opens, the SMS code verifies them, they get online. The box keeps the record.
One thing to watch: the router's own guest SSID does not pass through the box; it exits straight from the router. With two guest networks side by side, guests may pick the unrecorded one. So disable the router's guest SSID, or keep it for staff only. Show guests a single network name: the one that goes through the box.
You can keep using the router's guest network feature to separate staff phones from the internal network; the box separates guests, the router's guest network separates staff.
Four steps to make the switch
- Leave the router in place. Your internet subscription, modem and router do not change. One free port on the router is all the box needs.
- Connect the box. WAN side to the router, LAN side to the guest AP or to the guest VLAN on the switch. No static IP or port forwarding required.
- Move the guest SSID. Broadcast the guest network name from the AP behind the box and disable the router's own guest SSID. Guests keep seeing the same name and barely notice.
- Test. Join with your own phone, pass the portal, find your session and the day's record in the panel. The next day, confirm the timestamp was obtained.
In most businesses the switch takes an afternoon, and the only change guests notice is a one-time SMS code in place of a shared password.
Three questions to help you decide
- Who is the guest? A friend visiting your home: the router is enough. Anyone who walks through the door: records are needed.
- What would you show if a question came? The router cannot answer "who had this IP at this time".
- Who holds the records? With the box, records stay on your premises; they go neither to the cloud nor to us.
The box is a pfSense-based firewall and does not replace a corporate UTM, but it combines the separation and the records a guest network needs in one device. See the products page for the three product options, the box page for details, and the FAQ for common questions.
This article is for information only and is not legal advice.