In brief
Three common Wi-Fi setups fall short for guests: no identity, no record, or impractical onboarding. How a captive portal with an SMS code closes the gap.
For guest Wi-Fi you seem to have three ready-made options: write the password on the wall, leave the network fully open, or ask for a username and password as corporate networks do. Each does one thing well and one thing not at all. This post walks through where each falls short for guests, then shows how a captive portal with an SMS code fills the gap.
First, the yardstick: what should a guest network do?
Law 5651 expects a public-access provider to keep internal IP assignment records and protect their integrity. In practice that means being able to answer "which device, on which internal IP, connected when, and whose session was it". Add three criteria:
- Identity: can the session be tied to a person?
- Record: are the session start, end, MAC and internal IP kept reliably?
- Practicality: can a walk-in guest connect in 30 seconds?
Now run the three methods through them.
Shared password (WPA2/WPA3-Personal)
The most common approach. The password is on the wall, on the receipt or in the waiter's mouth.
- Identity: none. Everyone who knows the password connects as the same identity. You cannot say whose session it was.
- Record: incomplete. The modem or access point may keep a DHCP log, but it is usually short-lived, unsigned and not linked to a person.
- Practicality: medium. Typing a password is a chore; long ones cause errors, short ones leak to the shop next door.
One more problem: once the password is out, you cannot take it back. Changing it means every guest device reconnects. A phone that connected last year still connects if the password has not changed.
Open network
No password, everyone joins. In some setups "Enhanced Open" (OWE) encrypts the air traffic, but that encryption has nothing to do with identity; it only makes eavesdropping harder.
- Identity: none.
- Record: as incomplete as with a shared password.
- Practicality: the highest. One tap and you are on.
An open network is not a bad idea; it is simply incomplete on its own. A captive portal runs on an open network anyway: the guest joins without a password and the identity step happens in the portal. The open network is half of the solution.
WPA3-Enterprise (802.1X)
A separate username and password for each user, with a RADIUS server behind it. This is the right method for staff: sessions are tied to a person, and a leaked password affects one account.
- Identity: yes, strong.
- Record: RADIUS produces session records, but storing them, signing them and keeping them for 2 years remains a separate job.
- Practicality: low for guests. You would need to create an account for every walk-in, then explain how to install a certificate or profile on their phone. With foreign guests, older guests or a busy hour, that flow stalls.
Verdict: WPA3-Enterprise yes for staff, no for guests.
Side by side
| Method | Identity | Reliable record | Practical for guests |
|---|---|---|---|
| Shared password | No | No | Medium |
| Open network | No | No | High |
| WPA3-Enterprise | Yes | Partly, extra work needed | Low |
| Open network + portal + SMS code | Yes (phone number) | Yes | High |
The portal + SMS code path
With a captive portal the guest network stays open. The guest connects, the portal opens in the browser, they type their phone number and enter the code that arrives by SMS. That is all. Behind the scenes:
- The phone number is one an operator has assigned to a subscriber. The code reaching that number ties the session to it.
- The box stores the number encrypted and shows it masked in the panel; only an authorised role can reveal it.
- The device MAC, assigned internal IP and session start and end are recorded. Daily records are chained with SHA-256 digests, time-stamped under RFC 3161 and kept on the box for 2 years.
- Visited sites, messages and location are not recorded.
For the guest, this is shorter than typing a password: entering a number and a 6-digit code is easier than getting a 20-character passphrase right. Turn on device remembering and regulars are not asked for a code on their next visit.
Alongside SMS there are coupons (generated and printed in bulk), e-mail and registered-user login. In lodging or event scenarios a coupon gives a person-linked session without asking for a phone number: you know whom you handed the coupon to.
What about encryption?
A fair objection: on an open network the air traffic is not encrypted. In practice the vast majority of apps and sites use HTTPS today, so content is encrypted end to end. If your access point supports Enhanced Open you can turn it on; the portal does not get in the way. Client isolation on the access point stops guests from seeing each other. The box separates the guest network from the staff network with a VLAN.
The short decision
- Staff: WPA3-Enterprise, or at least a strong password on a separate VLAN.
- Guests: open network + captive portal + SMS code, with coupons and e-mail where they fit.
- Printers, POS terminals, TVs: a MAC exemption bypasses the portal, and they still appear in the records.
You can see how the box handles the guest side on the products page. It works without replacing your existing modem or access points. Questions go to the FAQ or the contact page.
This article is for general information and is not legal advice.