Enterprise
Offices and factories
Suppliers, auditors, subcontractors and service technicians come through the door every day and ask for internet. Hotspot-Box connects them without touching the production network.
- Never touches production
- 4 visitor types, 4 coupons
- Printer and IoT exemption
- Staff network separate
Who is the visitor connected to?
A supplier arriving for a meeting asks for the password; if IT is not around, someone reads out the staff password. From that moment an outside device is on the company network, where the file server, the printers and sometimes the production line's control screen share the same segment.
In a factory the risk is more concrete. A service technician wants internet to reach a machine remotely; a subcontractor crew is on site for weeks; an auditor comes for the day. Managing them all with one password means not knowing who connected when.
And if staff Wi-Fi and guest Wi-Fi share one network, there is no way to tell what counts as guest traffic for the Law 5651 record.
What the law expects from an office
A business that opens internet access to visitors may count as a collective-use provider under Law 5651; internal IP allocation records are expected to be kept, protected with a time stamp and retained for 2 years. Whether the network used by your own employees falls within that scope is debated; seek legal advice. The technical recommendation is the same under either reading: staff on their own VLAN with 802.1X, visitors behind a portal. This page is not legal advice.
This page is not legal advice; confirm your obligations with your legal adviser.
Setting up in an office or factory
- 1
The box sits behind your firewall, in front of the guest VLAN only. It does not replace your corporate UTM; it works alongside it.
- 2
The network is split in three: the production (OT) network reaches no wireless network at all; the staff network sits on its own VLAN, tied to company identity with 802.1X; the guest network sits behind the box. There is no route from the guest VLAN to production or staff.
- 3
The guest SSID is pointed at the portal; client isolation is enabled on the access points.
- 4
Visitor types become coupon groups: supplier (one day), auditor (one day, lower speed), subcontractor (project length), service technician (shift length). Each group carries its own duration and speed plan.
- 5
Printers, meeting-room screens and IoT sensors that must stay on the guest VLAN bypass the portal through MAC exemption.
Login method
Sign-in method
- SMS code
- Coupon
- Remembered device
SMS code for walk-in visitors and a coupon handed out at reception for planned ones are the primary methods. Device remembering is enabled for subcontractors who stay on site for long periods. Recommended plan template (staff): 20/10 Mbps, 10-hour session, 30-minute idle timeout, 3 devices, no quota, device remembered for 30 days. Shorten the duration for day-visitor groups.
Ready-made plan templates
Speed, session and device count are set per plan on the box, independent of the access point brand. The values below are our own lab recommendations and can be changed in the panel.
- Recommended for this sector
Staff-guest
Offices, factories, office towers, logistics, tutoring centres
- Speed (down / up)
- 20 / 10 Mbps
- Session
- 10 hours
- Idle timeout
- 30 min
- Devices
- 3
- Daily quota
- None
- Remembered device
- 30 days
Registered users or coupon groups; separate groups for suppliers and subcontractors.
Standard
Cafés, restaurants, shops, bakeries, salons, gyms
- Speed (down / up)
- 10 / 5 Mbps
- Session
- 2 hours
- Idle timeout
- 15 min
- Devices
- 2
- Daily quota
- 1 GB
- Remembered device
- Off
Keeps tables turning; a guest who wants more gets a coupon from the till.
Conference
Events, fairs, waiting lounges, cinemas, bank branches
- Speed (down / up)
- 5 / 2 Mbps
- Session
- 4 hours
- Idle timeout
- 10 min
- Devices
- 1
- Daily quota
- 500 MB
- Remembered device
- Off
Low speed and one device for many simultaneous users; capacity 250 concurrent devices.
Extended stay
Hotels, serviced apartments, dormitories, hospitals, residential complexes
- Speed (down / up)
- 15 / 5 Mbps
- Session
- 24 hours
- Idle timeout
- 30 min
- Devices
- 3
- Daily quota
- 5 GB
- Remembered device
- 7 days
No new code every day; in dormitories the remembered window can span the whole term.
What is recorded
- Verified phone number (encrypted, masked in the panel) or coupon code and group
- Device MAC address and internal IP
- Session start and end time
- NAT details where present
- Daily hash chain and time stamp
What is not recorded
- Websites visited
- Files, messages and content
- Location
- Staff network traffic
Example scenario
Example scenario: a two-line production plant
- Problem
- A factory with two production lines. Machine service visits a few times a month, a subcontracted maintenance crew has been on site for two months, a quality auditor comes four times a year. Everyone knows the staff password and the production screens are on the same network.
- Solution
- The production network was cut off from wireless entirely. Staff moved to their own VLAN with 802.1X. The box was installed in front of the guest VLAN. Four coupon groups: supplier 1 day, auditor 1 day at 5/2 Mbps, subcontractor 60 days, service 12 hours. Base plan 20/10 Mbps, 10-hour session, 3 devices. Reception hands out the coupon with the visitor badge.
- Outcome
- Outside devices now live only on the guest VLAN, with no route to production. Which company connected on which day shows from the coupon group. Nobody reads out the staff password any more, because there is no password left to read out.
An illustrative example; no real business is named.
Frequently asked
Does staff Wi-Fi fall under Law 5651 too?
Whether a network used by employees counts as collective use is debated; seek legal advice. The technical recommendation is clear: put staff on their own VLAN tied to company identity with 802.1X, and serve visitors behind the box through the portal. When the two networks never mix, the record question gets simpler too.
Can the guest network reach production systems?
Not when set up correctly. The guest VLAN sits behind the box with the internet as its only exit; there is no route to the production (OT) network or the staff network. The box is a firewall but does not replace your corporate UTM; your existing security layers stay in place.
What if a service technician needs remote access to a machine?
The technician reaches the internet through the guest network; access to the machine is opened separately under your OT policy, and the box does not open that door. The visitor is never put on the production network just for internet. A coupon in the service group valid for the shift is enough.
How do I separate visitor types?
Open a coupon group for each type: supplier, auditor, subcontractor, service. Each group has its own duration, speed and device count; you can give a subcontractor 60 days and an auditor 1 day. Reports show which group connected when.
How do printers and sensors get past the portal?
Add them to the MAC exemption list; they connect without seeing the portal. Use exemption only for devices that must stay on that VLAN, and move printers and IoT to their own VLAN where possible. Changes to the exemption list are written to the audit trail.
A 20-minute demo for your own venue
Let's work out your device count and sign-in method together.
Request a demo