How to Set Up a Separate Guest Wi-Fi Network in the Office

The short answer

A proper guest network is a separate SSID in its own VLAN with three rules: guests reach only the internet, guests cannot see each other, and guests cannot use up the whole channel. Add a password that changes regularly, and visitors get convenient access without touching your computers, printers or files.

Why the staff network is not for guests

A visitor's laptop or phone is a device you know nothing about. On the staff network it can:

• see shared folders, printers, NAS and cameras;
• scan the network and probe weak passwords;
• spread malware if it is already infected;
• eat bandwidth with large downloads or updates.

Giving guests the main Wi-Fi password also means the password leaks over time and is hard to change without reconfiguring every staff device.

Step 1. Separate the guest network from the internal one

There are two common ways:

• Built-in "guest network" option on the router or access point. Simple, but check what it actually isolates — on some devices it only hides the network, not blocks access.
• Dedicated VLAN (recommended). Create a guest VLAN, map a guest SSID to it on the access points and give it its own DHCP pool.

Then add firewall rules on the router:

• Allow guest VLAN → internet.
• Deny guest VLAN → all private ranges (staff, printers, servers, management).
• Deny guest VLAN → the router's admin interface.
• Allow DNS and DHCP so devices can connect.

Step 2. Enable client isolation

Client isolation (also called AP isolation or station isolation) stops guest devices from talking to each other. Without it, one infected phone can attack every other guest laptop in the meeting room.

• Turn it on for the guest SSID on every access point.
• If you have several access points, check that isolation also works between points, not only within one.

Step 3. Limit speed

A single guest downloading a large file can slow down video calls for the whole office. Options:

• Per-client limit — a cap for each guest device.
• Total limit for the guest VLAN — guests share a fixed slice of the channel.
• Traffic priority (QoS) — staff traffic goes first when the line is busy.

Set limits so that browsing and video calls stay comfortable for guests while the office keeps most of the channel.

Step 4. Manage access: password, QR code or portal

Practical tips:

• Change the guest password on a regular schedule, for example monthly, and after events with many visitors.
• Print the QR code in a frame that is easy to replace.
• Use WPA2 or WPA3 encryption even for guests. An open network lets anyone nearby read unencrypted traffic.
• Set a session timeout if your equipment supports it.

A Wi-Fi QR code uses a standard text format that phone cameras understand:

WIFI:T:WPA;S:Office-Guest;P:YourGuestPassword;;

Step 5. Test it

After setup, connect a phone to the guest network and check:

• Internet works.
• Internal addresses (printer, NAS, router admin page) do not open.
• Another guest device cannot be pinged.
• Speed stays within the limit you set.

Repeat the test after firmware updates or configuration changes.

Common mistakes

• Guest SSID in the same subnet as staff — the name differs, but access is the same.
• Router admin page reachable from the guest network.
• Open network without a password — no encryption and no control over who connects.
• Password never changes — former employees and old visitors keep access for years.
• No speed limit — one guest affects everyone's calls.
• Staff use the guest network to bypass restrictions, so their devices end up outside your policies.