In brief
Guest Wi-Fi should never share a network with the till, printers and file server. Client isolation on the AP, VLAN separation on the box, and a ten-minute three-step self-test.
If your till, printer, camera recorder and accounting PC hang off the same cable as the guest Wi-Fi, you are giving guests more than internet: you are giving them your internal network. Most small businesses never notice, because nothing visibly "breaks". This post shows how to separate the two networks and how to test, in ten minutes, that the separation really works.
Two layers: isolation and separation
You build the separation in two different places; neither replaces the other.
Client isolation on the access point
This AP setting stops devices on the same guest network from seeing each other. One guest's phone cannot reach another guest's laptop. It protects guests from each other. It does not protect your internal network; that is the next layer's job.
VLAN separation on the box
A VLAN is a way to run virtual networks that know nothing of each other over the same switch and the same cable. Guest traffic travels in one VLAN, staff traffic in another. Hotspot-Box is the exit door of the guest VLAN: guest traffic reaches the internet through the box and never reaches the staff network at all. Because the box is a pfSense-based firewall, the rule between the two networks is explicit: no path from guest to staff.
The box does not replace a corporate UTM appliance. The staff network's own security (antivirus, updates, password hygiene) is a separate matter. The box's job is to keep guests out.
Where the box sits
A simple layout looks like this:
- The modem/router reaches the internet and hands one cable to the box.
- The box manages the guest VLAN: it assigns IPs, shows the portal, keeps records and filters traffic.
- The switch carries the guest VLAN to the guest SSID on the APs, and the staff VLAN to wired PCs and the staff SSID.
- The APs broadcast two SSIDs: guest (guest VLAN tag) and staff (staff VLAN tag).
Your existing modem and APs stay in place; the box slots in between. No extra licences are needed.
The three-step self-test
Once the separation is built, behave like a guest. Join the guest SSID with your phone, go through the portal and run these three steps.
Step 1: Ping the staff network's gateway
Ping the staff network's gateway address (for example the router's IP on the staff side) with a network tool app.
- No reply: the expected result. The guest VLAN has no route to the staff network.
- Reply: there is no separation, or a guest-to-staff rule is open on the box. Check the guest SSID's VLAN tag and the firewall rules on the box.
Step 2: Scan the network
Scan the guest network with the same app. Which devices show up?
- Only your own phone and the gateway (the box): the expected result. Client isolation is on.
- Other guests' phones appear: client isolation is off on the AP. Turn it on; with several APs, on each one.
- A printer, till or camera appears: those devices are plugged into the guest VLAN. Check the switch ports; one is probably in the wrong VLAN.
Step 3: Try the printer
Type the staff printer's IP into the browser or try to print from the phone.
- Unreachable: the expected result.
- The printer's web interface opens: the printer is on the guest side, or a path exists between the two VLANs. If a printer is meant for guests (document printing in a hotel lobby, say), its place is on the guest VLAN with a MAC exemption on the box, not the staff printer.
Reading the results
| Step | Expected | Deviation | Where to look |
|---|---|---|---|
| Ping | No reply | Reply | Guest SSID VLAN tag, box rules |
| Scan | Only you and the box | Other guests | AP client isolation |
| Scan | Only you and the box | Internal devices | Switch port VLAN assignments |
| Printer | No access | Interface opens | The printer's switch port, box rules |
If all three steps give the expected result, the separation works. Repeat the test every six months and after every network change; an electrician finding a "spare port" and plugging a camera into it is a story that happens often enough.
Three common mistakes
- Separation by password only. A guest SSID and a staff SSID on the same flat network. Different passwords, same cable. Anyone who passes the portal is on the staff network. Separation needs a VLAN, not a second password.
- Isolation on, wired devices forgotten. Client isolation on the AP is enabled, but the recorder and the till are plugged into the same unmanaged switch as the guest AP. Wireless guests cannot see each other, yet they can see every wired device.
- MAC exemption used for staff. A staff laptop is exempted so it skips the portal. It now has internet without verification but still lives on the guest VLAN, cut off from the printer and the file server. Exemption is for devices that cannot pass a portal, not for people who do not want to.
Devices deliberately on the guest side
Some devices belong on the guest side: the lobby smart TV, a guest printer, a menu tablet. They cannot pass a portal. You define a MAC exemption on the box; the device goes online without verifying but stays in the guest VLAN and cannot reach the staff network. An exemption means "skip the portal", not "skip the separation".
For a more detailed four-VLAN layout see the box page and the industry guides. If you would like a layout suggestion for your existing network, contact us.
This is a technical guide, not legal advice.