Guest Wi-Fi on UniFi, done properly

Guest Wi-Fi is one of those jobs that looks finished the moment visitors can get online. The real question is what else they can reach once they are on it. On UniFi, a few switches in the right places stop a guest's laptop from seeing your printers, your NAS or each other.

What can go wrong

A badly set up guest network often sits on the same subnet as staff devices, or on its own VLAN with no firewall rules between them. Either way, a visitor's laptop, which you know nothing about, can scan your network, find the file server and try the printer's web page. If that laptop is carrying malware, it now has a path into your network. Guests can also reach each other, which matters in a waiting room or a shared office.

The aim is simple: guests get the internet and nothing else.

Layer 1: put guests on their own network

Ubiquiti's own guest Wi-Fi guidance starts with the network, not the SSID. In UniFi Network, go to Settings > Networks, create a network for guests, and turn on Network Isolation. This separates that network (and its VLAN) from all your other networks. Then go to Settings > WiFi, create the guest SSID and assign it to that network.

Give the guest network its own subnet and keep it obviously different from your staff ranges. When you are reading logs or a DHCP table later, seeing a guest address at a glance saves time.

Layer 2: stop guests talking to each other

Network Isolation keeps guests away from your network, but devices on the guest network can still see each other. Ubiquiti's guide adds two more settings:

Client Device Isolation on the WiFi stops clients on the same access point talking to each other.
Device Isolation (ACL) finishes the job at switch level, so the isolation holds as traffic crosses your UniFi switches.

Turn both on for any guest or public network. Nobody on guest Wi-Fi needs to reach another guest's phone.

Layer 3: a captive portal, if you need one

A Hotspot Portal makes guests sign in through a captive portal before they get online. According to Ubiquiti's hotspot documentation, you can enable it per SSID under Settings > WiFi, or for a whole network through the Hotspot zone under Settings > Security > Firewall, which needs the zone-based firewall in Network 9.0 or later.

Authentication options include a shared password, vouchers (which can carry time, bandwidth or data limits), payment through Stripe, RADIUS, or an external portal. For most small offices, vouchers or a simple password that you change regularly are enough. Vouchers are handy for events because each one expires on its own.

You can brand the landing page under Insights > Hotspot > Landing Page. It is also a good place to put a short acceptable use notice.

Layer 4: keep guests from hogging the line

Guests should not be able to slow down the people doing paid work. Ubiquiti's guidance points to three options:

Proxy ARP on the guest WiFi lets the access point answer ARP and other common broadcast traffic itself, which cuts airtime on busy networks.
Speed limits cap how much bandwidth guest clients can use.
Traffic Management can block heavy or non-essential apps, such as large file transfers.

Start with a sensible per-client limit and adjust it if people complain. A guest network that crawls is almost as unhelpful as one that is wide open.

Test it like a guest

Settings only count if they work. After any change, join the guest SSID on a phone or spare laptop and check:

You can browse the internet.
You cannot open the web page of a printer, NAS or switch on your staff network.
You cannot ping the gateway address of your staff VLAN or a known staff device.
A second test device on the guest network cannot reach the first.

Write down what you tested and when. If someone later asks whether guests can reach the file server, you have a clear answer.

A few habits worth keeping

Never reuse the staff Wi-Fi password for guests, and change the guest password on a schedule.
Don't put shared printers or smart TVs on the guest network to make things easier. Give them their own network with only the access they need.
Review the guest setup after every UniFi Network upgrade, especially major ones that change the firewall model.
Take a backup of the console before and after you make changes.

Getting guest Wi-Fi right takes about half an hour on UniFi. The settings are all there. The work is in turning them on, and then testing like a guest would.

Sources

← All posts