Guest Wi-Fi Guide: Sign-in, VLAN, Plans, Capacity

Why a shared password is not enough

A Wi-Fi password pinned to the wall or printed on the receipt lets guests onto the network but says nothing about who they are. Everyone signing in with the same password looks identical in the record; when a request arrives there is nobody you can point to as ‘the person connected at that hour’. The password leaks, the shop next door uses it, a former employee remembers it. And when you change it, a hundred guests have to be told the new one, one by one.

An open network, that is Wi-Fi with no password, makes the picture worse: traffic flows unencrypted over the air and there is still no identity. Enterprise methods such as WPA3-Enterprise require a separate account for every user; right for staff, unworkable for a guest who drinks a coffee and leaves. The only structure that works for guests is a captive portal that ties identity to a code or a coupon.

The ‘guest network’ switch on the modem or router does not close this gap. It separates guests from the business network, which is good; but it does not verify identity, keeps no session record and signs nothing. That is why guest Wi-Fi design starts not with ‘which password should we set’ but with ‘how will the guest identify themselves and how will we record it’.

Sign-in methods: SMS code, coupon, e-mail, registered user, device remembering

The SMS code is the primary method. The guest enters their number, the box passes the code straight to your SMS provider, the guest types the code and the internet opens. Because the number is already registered to a person on the operator's side, the record is tied to an identity; the guest installs nothing. SMS also reaches foreign numbers, and a separate provider can be set for international traffic if you wish. Sending the code over WhatsApp is available as an addition to SMS. The cost is one SMS per code; device remembering lowers it noticeably.

Coupons are for cases where you prefer not to take a number or the guest's phone has no signal: a conference hall, a hotel room, a dormitory term. You generate coupons in bulk from the panel, print them or have them printed on the receipt. Single-use or group code, how many devices, valid for how many hours or days: these are set in the coupon rule, and the coupon code is written to the record. The weak point is that you need to know who received the coupon; the room record at a hotel or the attendee list at an event provides that link.

E-mail sign-in, where the code goes to an e-mail address, suits settings such as corporate visitors and office lobbies. A registered user gets a username and password, for staff and long-stay guests; because the account belongs to a person, the record is still tied to an identity. Device remembering is not a sign-in method but a complement to the others: a verified device is not asked for a new code for the period you set. MAC randomisation on phones can break this; the guest signs in with a code again and the record is still kept. We do not offer social media sign-in: it does not count as identification and loads the business with unnecessary profile data.

Network design: VLANs, isolation and where the box sits

Guest traffic and business traffic should not flow on the same network. The tool for this is the VLAN: separate virtual networks over the same switches and cables. For a small business four VLANs are enough: guest, staff, POS and cameras. The access point broadcasts two SSIDs; the guest SSID maps to the guest VLAN, the staff SSID to the staff VLAN. Guests never see the till or the camera recorder.

The box sits at the guest VLAN's gateway to the internet: behind your existing modem and switch, in front of the access points. It does not replace the modem, needs no extra licence on your existing equipment and no static IP; it even works on a 4.5G backup line behind CGNAT, because connections go outward from the box. The box is a firewall that separates the guest network; it does not replace your enterprise UTM, it works alongside it.

Turn on client isolation at the access point so that devices on the same guest network cannot see each other. If you have several access points, keep them all on the same guest VLAN; because the box tracks the session by the device's MAC address, the portal does not reopen as the guest roams between them. Keep screenless devices such as printers, TVs and POS terminals outside the portal with a MAC exemption. On the staff network, consider 802.1X with RADIUS instead of a shared password; that network should be tied to individuals too.

Plans and fair use

A plan defines what a guest gets: download and upload speed, session duration, idle timeout, device count and daily quota. All of it is set in one place, in the box, and applied regardless of access point brand. Our lab recommendations come as four templates. Standard (cafe, shop, hairdresser): 10/5 Mbps, 2-hour session, 15 minutes idle, 2 devices, 1 GB a day. Conference (events, waiting rooms): 5/2 Mbps, 4 hours, 10 minutes, 1 device, 500 MB. Staff-guest (office, factory): 20/10 Mbps, 10 hours, 30 minutes, 3 devices, no quota, 30-day device remembering. Long stay (hotel, dormitory, hospital): 15/5 Mbps, 24 hours, 3 devices, 5 GB a day, 7-day device remembering.

When the quota runs out, cut off or slow down? For the guest experience slowing down is gentler, cutting off is clearer; what matters is that the outcome is written in advance on the portal and in the terms of use. A fair-use policy is not a long contract but a clear text of four or five points: speed limit, quota, session duration, prohibited use and the fact that a record is kept.

Scheduled on/off is not a feature of the box; you reach the same result with session duration and coupon validity. For a network that should close at the end of the working day, set the session duration to match the working hours; for access tied to a stay, generate coupons by the length of the stay. Content filtering and VPN blocking are not in the box either; they belong to a separate DNS or security layer and do not replace the record-keeping obligation.

Portal and consent

The captive portal is the page a guest sees before reaching the internet. A good portal does three things: it carries your brand, shows the privacy notice and terms of use before a code is requested, and finishes sign-in in two steps. The addresses reachable before sign-in (the walled garden) are kept limited: the portal itself, the privacy notice and, if you wish, your business website.

Separate two things when it comes to consent. The access record is kept because the law requires it; no consent is sought for that, a notice is given. A marketing message needs a separate, explicit opt-in; that checkbox stays empty by default and when ticked the box stores it as an explicit consent record. Our recommendation is to collect nothing that is not required: date of birth, gender or a forced ‘follow us’ are not needed for the record and increase the KVKK burden.

The post-login screen is useful space for the business: a QR menu, the day's announcement, a short survey or a redirect to your website. If the portal does not open, the cause is usually DNS, the clock or the walled garden setting; iPhone and Android detect portals differently. If the code does not arrive, the SMS provider's balance, the sender ID approval and the number format are the first places to look.

Capacity planning

The box is licensed for 250 concurrent users. Concurrent means devices with an open session at the same moment; the number of guests per day is many times higher, because sessions open and close in turn. The rough calculation goes like this: multiply the number of guests at your busiest hour by the devices per person; if the figure stays below 250, one box is enough. Keeping session duration and idle timeout short lowers the concurrent count.

Two formulas are enough for bandwidth. Line capacity: concurrent users times average usage; not everyone downloads at full speed at once, so plan speed and average usage are different things. Access point count: coverage by floor area and wall construction, load by the number of devices at the busy hour. Loading too many devices onto one access point makes a fast line pointless.

Put the box in a locked cabinet behind a UPS; records must keep being collected through a power cut and the shutdown must be clean. After installation run the 10-point acceptance test: does the portal open, does the code arrive, can a guest see the staff network, is the clock in sync, is the stamp being obtained, does export work. If you have several branches, each branch gets one box; you watch their health from head office on a single screen while the records stay in each branch's own box.

Box, virtual appliance or SaaS?

The box and the virtual appliance run the same software; SaaS offers the same portal in the cloud. The difference is where it runs, what it covers and how you pay. Box + Software: 45,000 TL + VAT, perpetual licence, 250 concurrent users; the simplest route for a business without technical staff, because the hardware arrives ready. Virtual Appliance: the same software as a virtual machine on ESXi, Proxmox VE, Hyper-V or KVM; for a business that already has a server and does not want to buy hardware. SaaS: a monthly or yearly subscription; no device on site, your existing router or AP controller redirects guests to the portal in the cloud. Portal, SMS verification, plans and reports run in the cloud; no Law 5651 records are kept.

With the box and the virtual appliance the records stay on your premises. This is a deliberate choice: records go neither to the cloud, nor abroad, nor to us; hotspot-box.com never sees a guest's phone number, it only issues the SMS API credentials and counts credits. Apart from health data, the box sends nothing out. With SaaS, verification happens in the cloud and no Law 5651 records are kept; if you have the legal record obligation, choose the Box or the Virtual Appliance.

Three questions settle the decision. What is the total bill over five years: perpetual licence or subscription? When the contract ends, where do the records stay and can they be verified for two years? Is the invisible bill of hotspot software installed on a PC (operating system, updates, that PC staying on at all times) really cheaper than a box? The seven-day free trial is the way to see the answer on your own network.

Continue by industry

Cafes and restaurants have no technical staff, so the setup must stay simple; in hotels, foreign guests and floor density come to the fore; in shopping centres, network separation and busy-hour capacity are decisive. We have gathered the recommended plan, sign-in method and network layout for each industry in the industry guides. Record keeping, time stamps and retention are covered in the Law 5651 guide, the terms in the glossary, and short answers on the FAQ page.

Guest Wi-Fi guide: sign-in method, network design, plans and capacity