← Back to Broadband & VoIP guides

Guest Wi-Fi vs Staff Wi-Fi — SME Best Practice

Offering “Free WiFi” on the same SSID and subnet as your EPOS, printers and VoIP handsets is how coffee shops leak VLAN broadcasts and invite PCI scope creep. Split networks at layer-2 with a firewall in between — not just a different password on the same bridge.

Next step: Ensure your router or firewall supports multiple SSIDs → VLANs. Contact us for retail network refreshes.

VLANs and ACLs

Guest VLAN: internet only, DNS to trusted resolvers, block RFC1918 except captive portal. Staff VLAN: reach servers and printers explicitly; default deny from guest to staff. Log DHCP for rogue AP detection.

Captive portal trade-offs

Marketing splash pages annoy users but document acceptance of acceptable-use policy. WPA3-Enterprise on staff SSIDs beats shared PSK rotation nightmares for laptops.

Bandwidth fairness

Rate-limit guest egress so a YouTube binge does not starve card authorisations — align with QoS on the WAN.

IoT and CCTV

Cameras and HVAC controllers belong in a third “device” VLAN with no internet or one-way updates only — they should never sit with guest phones.

Related guides

Ready to compare? Start the broadband path on our homepage or message the team.