| Guest WiFi gives visitors an internet connection without giving them routine access to your business systems. A separate network name makes it easy to find, but the network configuration and access rules provide the separation. Visitor-to-visitor access needs its own controls. |
A courier at reception in a Christchurch office asks for the WiFi password. The receptionist reads it off a card under the desk. It is the same password the accounts team uses, and it has been shared with every visitor for years. Nothing about that card tells anyone which devices are on the network or what they can reach.
This guide explains what makes guest WiFi separate, how to check it, when a login page is useful and how to manage the capacity guests share with your staff. For design, installation and ongoing management, see our business WiFi service.
What is guest WiFi?
Guest WiFi is a wireless network for visitors that provides internet access while restricting access to business systems. It appears as its own network name, runs on its own network segment, and follows rules that block routes into the business network and its equipment. Business WiFi is the wider service and can include both the staff network and the guest network.
| Question | Staff network | Guest network |
|---|---|---|
| Who uses it | Approved staff and business devices | Visitors and other approved personal devices |
| What it can reach | Systems allowed for the user and device | Internet and necessary supporting services; business systems blocked by policy |
| How access works | Authentication suited to business requirements | Password, voucher, login page or another agreed method |
| How capacity is managed | Designed around business applications | Limits suited to visitor demand and shared capacity |
Who counts as a guest?
Anyone who needs an internet connection but not your systems: clients in reception, patients in a waiting room, couriers, tradespeople, auditors and job candidates. Contractors depend on the work. One who needs only email and their own cloud tools can use guest WiFi; one who needs your line-of-business system needs a proper account and an agreed device arrangement.
Is guest WiFi just a second password?
No. A second password on the same network still leads to the same network. The device gets a different way in and the same access once connected. The separation comes from the network segment and the rules that stop guest traffic reaching your systems, not from the password.
Why keep visitors off the staff network?
You have no control over the devices visitors bring, and no way to know what is already on them. On a flat network, a visiting device can reach the same file shares, printers, cameras and other equipment as staff devices, depending on how those systems are configured. Guest WiFi reduces that exposure without needing the visitor to do anything wrong.
A shared staff password also travels. It gets typed into personal phones, written down and passed on, and changing it means updating every staff device and printer at once. A separate guest network lets you change visitor access details without touching business devices. Client security questionnaires and cyber insurance applications may also ask whether visitor traffic is separated from business systems.
Printers, cameras, door controllers and other connected devices raise their own questions about firmware and default settings, which our post on IoT security covers.
What makes guest WiFi separate?
A guest network uses a separate network segment, such as a VLAN, with rules that block access to business systems and to the management interfaces of your network equipment. A VLAN creates the logical segment; it does not by itself enforce every access restriction. Guest WiFi still needs permitted services, such as address allocation and DNS, to work, and the rules must cover every route available on the site, including IPv6 where it is enabled.
- Separate segment. Guest devices get their own network and address range, kept apart from staff and equipment networks
- Access rules. Firewall or gateway rules block business systems and equipment management, while allowing the internet and the services guests need
- Guest-to-guest isolation. Client isolation stops visitors reaching each other, checked across every access point and switch
- Additional controls. DNS filtering and traffic limits help, but they are not what makes the network separate
Check guest-to-guest isolation across the whole network. On some equipment, an access point setting only covers devices on that access point, and switch or gateway controls are needed for the rest. Ubiquiti, for example, separates network isolation, switch controls and client device isolation as different layers. Avoid assuming a single checkbox completes the job across all equipment.
Illustrative. The separation depends on configured and tested rules, not on the diagram or the network name.
How do you separate guest WiFi from the internal network in a small shop?
Start with what the existing router, access points and firewall support. Business equipment can run a guest network on its own segment with rules and isolation; consumer router guest modes vary by model, and some offer only a second network name with limited control over what is blocked. Check the model’s documentation rather than assuming a guest mode provides isolation.
Keep staff devices, EFTPOS terminals, printers and cameras off the guest network. Whether some of those devices also warrant their own segment depends on the setup and the risk, so decide that during the design rather than applying one rule to every site. Then test the guest network before handing out the details.
How can you check the separation?
Have your provider test from the guest WiFi against known working business resources and management interfaces that should be blocked. A printer page failing to load does not confirm every rule: the printer could be offline, use another address or have its own firewall. Successful access to something that should be blocked identifies a problem, but not necessarily its cause.
Check guest-to-guest access across access points too, and include IPv6 where it is enabled. Record the checks and repeat them after firmware updates, equipment replacements and other relevant changes, because a change elsewhere can alter how the guest network behaves.
Does your business need a captive portal?
A captive portal is the page a visitor sees before getting normal internet access. It can show terms, offer a voucher or another access method, and apply session settings supported by the system. A small office may manage well with a separate guest password. A public venue may benefit from more structured access, such as vouchers or expiring access for each stay.
Choose the method around the visitors and the service you are offering. A portal does not by itself prove a visitor’s identity, encrypt an otherwise open wireless connection or replace network isolation. It also does not require you to collect names and email addresses.
Can you collect visitor email addresses?
Collect personal information only when it is necessary for a lawful purpose connected with your business. Privacy principle 3 means explaining what you collect and why, who will receive it and what happens if the visitor does not provide it. Set appropriate access and retention rules for anything you keep, and start with the least personal information the guest WiFi service needs.
If you want to send marketing emails, use a clear, separate opt-in. New Zealand’s spam law also requires accurate sender details and a functional unsubscribe facility in each commercial message. Joining the WiFi is not, by itself, an agreement to join your mailing list.
What should the access notice cover?
Explain who provides the connection, permitted use, any access or session limits and how to get help. If activity or device information is logged, say what is recorded and link to the privacy explanation. Describe any filtering accurately, and have the terms checked for your setting rather than relying on a blanket statement about liability.
Will guest WiFi slow staff down?
Guests may share WiFi airtime and internet capacity with staff. A per-device limit stops one visitor taking a large share, a total guest allocation caps what all visitors use together, and priority rules can put business calls and applications ahead of guest traffic when the connection is busy. Those limits help manage demand; they do not create radio airtime or remove interference, so coverage and the number of active devices still matter.
Check performance during representative busy use before setting the numbers. Ubiquiti’s guest WiFi guidance, for example, pairs isolation with speed limits and other performance settings. Session lengths and switching the guest network off outside opening hours are further options. Sizing the connection itself is covered in our guide to business internet.
What does guest WiFi need from the network underneath?
Guest WiFi needs access points that can run more than one network, switches configured to carry the guest segment correctly, and a firewall or gateway that enforces the rules. The access points covering reception, waiting areas or a cafe floor also need cabling and placement that reach those spaces. Our network cabling service covers the wired side.
Existing equipment may be suitable. Older or unsupported equipment, or visitor areas without coverage, can turn a configuration job into a larger project, which is why the first step is checking what the current equipment supports.
What goes wrong with guest WiFi?
The biggest fault is guest WiFi that looks separate and is not: it has its own name and password, but a device on it can still reach an internal address because a rule was not configured or was lost in a later change. Other faults include:
- The staff password handed out anyway. Reception still gives out the staff password because that is the one written down; print the guest details instead
- Isolation on one access point only. Guests on different access points or switches can still reach each other
- No limits on the guest side. A large download on a visitor device competes with business calls
- An open network with no notice. Visitors connect without terms, help details or any explanation of logging
- A setup nobody retested. A firmware update or replacement switch changes the guest network behaviour, and nobody checks
How much does guest WiFi cost?
The cost depends on what your current access points, switches and firewall support, the visitor areas needing coverage and the access method you choose. Ask for investigation, equipment, installation and configuration costs separately from recurring licences and management, and confirm whether a branded portal, vouchers, filtering, testing and staff instructions are included. Agree the work and change window before setting an installation date.
Who looks after guest WiFi afterwards?
Agree who manages updates, access details, portal settings and faults. The support arrangement should identify the equipment covered, support hours and when access rules are retested. Change shared passwords or vouchers when their exposure or your operating process calls for it; the right access lifecycle depends on how visitors use the site.
What to ask for during setup
Confirm the guest areas and expected demand first. Then agree the separate network, access rules, visitor-to-visitor restrictions, wireless security, any portal or filtering, and traffic limits. Check that the necessary internet services still work, that business access is blocked as intended and that staff can explain how visitors connect. Where the guest network sits within wider access rules, our network security guide covers the rest of the network.
Guest WiFi setup from Exodesk
Exodesk sets up and supports guest WiFi as part of our business WiFi service: the separate network and access rules, client isolation, filtering, traffic limits and priority, vouchers or a branded login page where they suit the site, and testing before handover. Ongoing management is agreed in the support arrangement for your site.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
NEXT STEP
Need guest access set up or checked?
Exodesk’s business WiFi service covers design, installation, testing and ongoing management, with the work agreed for your site. Tell us where visitors need access, how many devices are likely to connect and what equipment you already have.
Frequently Asked Questions
What is guest WiFi?
Guest WiFi is a wireless network for visitors, configured to provide internet access while restricting access to business systems. A different network name helps visitors connect. The access rules provide the separation.
How much does guest WiFi cost to set up?
It depends on the existing equipment, coverage, access method and testing required. Suitable equipment may only need configuration, while older equipment, cabling or extra coverage add to the work. Confirm one-off work and recurring costs in the quote.
Is guest WiFi safe for a business to provide?
A well-configured guest network reduces exposure from visitor devices. Separation, appropriate wireless security, maintenance and testing work together. No guest network removes every risk.
What is the difference between guest WiFi and business WiFi?
Business WiFi covers the wireless networks your workplace needs, including staff and guest access. The guest network is the visitor part, with access restricted to suit that purpose. Staff devices use the business network with the access their work requires.
Does a business need a captive portal for guest WiFi?
No. A separate guest password may suit a small office. A portal can help manage access, terms or sessions in other settings. It is an option rather than the source of isolation.
How do you stop guest WiFi slowing down the business?
Use traffic limits and suitable priority alongside a design that accounts for shared airtime, interference and busy periods. Limits help manage demand. They cannot promise that staff will not notice guest use at busy times.
Can devices on a guest network see each other?
They may be able to unless suitable client isolation is configured. Check the behaviour across access points and switches, rather than assuming one wireless setting covers every path.
Does guest WiFi need a separate internet connection?
A second connection is not required for guest WiFi to work. Guests can share the business connection while network rules restrict access to internal systems. A second connection is an option when capacity or operational requirements justify it.
How frequently should the guest WiFi password change?
Set the process around how far access details are shared and how long visitors need them. Change details after unintended disclosure. Vouchers or expiring access can help, and a portal does not automatically remove shared passwords.
Can a business collect email addresses on a guest WiFi login page in New Zealand?
Only collect information necessary for a lawful business purpose, and explain its use at collection. If you plan marketing emails, obtain an appropriate consent basis and provide sender details and an unsubscribe facility. Joining the WiFi is not by itself agreement to receive marketing.
How can you tell if guest WiFi is actually separated?
Have your provider test access to known working resources that should be blocked, plus visitor-to-visitor paths and equipment management. A single page failing to load does not prove complete separation. Retest after relevant changes.
Does Exodesk set up guest WiFi in Christchurch and Dunedin?
Yes. Exodesk has supported New Zealand businesses since 1989, and our Christchurch and Dunedin teams support businesses nationwide. The quote confirms the guest configuration, site attendance, testing and any ongoing management included for your location.
Contact us or call 0800 396 337 to discuss guest WiFi for your premises.
