If your venue offers guest WiFi, it should not run on the same network as your tills, card machines and office computers. Keeping them apart is one of the simplest and most useful things you can do for security and for reliability.
The risk of one shared network
Everything on a network can, by default, see other things on it. On a single shared network, a guest's phone sits next to your till system and your back-office PC. Most guests mean no harm, but a phone with malware, or one person who does mean harm, would have a route to your business equipment that should never exist.
A single shared password makes it worse. It ends up on menus, in group chats and with former staff, and you cannot tell who is using it.
What separation looks like
- Two network names. One for staff and equipment, one for guests. Give guests access only to the guest network and keep staff credentials private.
- Separate network segments. On business-grade equipment, each network name has to be mapped to its own segment, called a VLAN. Extra network names do not do this on their own, and VLANs can still reach each other through routing.
- Firewall rules. Rules that block the guest segment from reaching the business segments, so traffic really does stay apart.
- Guest isolation. A separate setting, often called client isolation, that stops guest devices talking to each other, so one guest cannot reach another's phone.
- Limited internet only. The guest network can reach the internet and nothing else on your site.
Other benefits
- Reliability. A guest streaming video should not slow your card machines. You can cap guest speeds so the business always has room to work.
- Simpler staff access. The staff network can keep a private password that changes when someone leaves.
- Clear terms. The guest network can show a login page with your terms. The staff network does not need one.
Rule of thumb: if a device is paid for by the business and handles money or business data, it belongs on the staff network. If it belongs to a customer, it belongs on the guest network.
Check what you have
Many venues find that guests and staff are on the same network because that is how the router was first set up. Ask whoever installed your WiFi whether guest traffic is separated from your tills. If they are not sure, it is worth a check. Consumer routers often cannot do this properly, which is one reason to choose business-grade equipment. Our hardware buying guide explains what to look for.
For the full setup order, read how to set up guest WiFi for a venue. If you would like to see a branded guest login in practice, book a 15-minute demo.