Tutorials · Wi-Fi
How to Set Up Secure Guest Wi-Fi With Client Isolation
Give visitors Internet access without exposing your internal network: separate SSID and VLAN, client isolation, bandwidth limits and an optional captive portal.
Before you start
- Access points managed by a gateway or controller
- A guest VLAN and subnet
- A firewall or gateway that can route the guest VLAN to the Internet only
Step by step
Create a guest VLAN
For example VLAN 40 with its own DHCP scope, such as 10.40.0.0/22.
Create the guest SSID
In the controller, add an SSID such as 'Company-Guest' mapped to VLAN 40. Use WPA2/WPA3-Personal with a rotating password, or an open network with a captive portal.
Enable client isolation
Turn on 'client isolation' or 'station isolation' so guests cannot see each other's devices.
Block internal networks
On the gateway or firewall, deny traffic from the guest VLAN to every private range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and allow only DNS and Internet.
Limit bandwidth
Set per-client limits, for example 10 Mbps down and 5 Mbps up, so guests cannot saturate the link.
Add a captive portal (optional)
Show terms of use or require a voucher. Hotels and venues often print vouchers from the portal system.
Pro tips
- Change guest passwords regularly.
- Keep the number of SSIDs low: each one consumes airtime.
FAQ
Frequently asked questions
Is client isolation enough to protect my network?
No. Combine it with a separate VLAN and firewall rules that block all internal subnets.
Keep learning
Related guides
Hotel solution
Read more →Navijin Cloud captive portal
Read more →How to Plan Wi-Fi Channels on 2.4, 5 and 6 GHz
Reduce interference and increase capacity by choosing the right channels and widths for each band.
Read more →How to Secure Wi-Fi With WPA3-Enterprise and RADIUS
Replace shared Wi-Fi passwords with per-user authentication using 802.1X, a RADIUS server and WPA3-Enterprise (or WPA2-Enterprise for older devices).
Read more →How to Improve Wi-Fi Roaming With 802.11k and 802.11v
Help phones, laptops and scanners move smoothly between access points without dropping calls.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.