What is a guest network?
Most small office/home office (SOHO) routers and business access points can broadcast a second SSID (service set identifier, the Wi-Fi network name) for visitors. Devices that join it can reach the internet, but the router blocks them from the main network's PCs, printers, file shares, cameras and the router's own admin page. A guest network lets you hand out Wi-Fi without handing out the main Wi-Fi password or trust in the devices that use it.
Settings that make it a real guest network
- Separate SSID and passphrase. Never reuse the main network's key. If the guest password spreads, you can change it without reconnecting every staff device and printer.
- Block guest access to the LAN. Vendors label this differently, for example "Access intranet" or "Allow guests to see each other and access my local network." It should be off.
- Client isolation (AP isolation). Stops guest devices from talking to each other, so one visitor's infected laptop cannot probe another visitor's phone.
- Encryption. Use WPA3-Personal, or WPA2-Personal with AES where older devices need it. Leave the network open only when policy requires it, as many public venues do.
- Bandwidth limits. Cap guest throughput so one large download does not slow business traffic.
- Schedules and time limits. Turn guest Wi-Fi off after hours or expire access after a set time.
- No management access. Make sure the router's admin page cannot be reached from the guest SSID.
Captive portals
Hotels, cafés and offices often add a captive portal, a splash page that appears before internet access is granted. Visitors accept terms of use, enter a voucher code or sign in. A captive portal controls who gets on and records acceptance, but it does not encrypt traffic, so it does not replace WPA2 or WPA3.
How the separation works
On a consumer router, the guest SSID is usually placed on its own subnet with internal firewall rules that allow only internet-bound traffic. In business networks, the guest SSID is typically mapped to a dedicated VLAN (virtual LAN) whose traffic is routed straight to the internet, with access control lists blocking internal ranges.
Common uses
- Visitors, customers and short-term contractors
- Smart TVs, speakers, cameras and other IoT devices that rarely get updates, kept away from computers that hold sensitive data
- Test equipment and personal devices in a small office
The trade-off is that isolated devices cannot reach the main network, so casting to a TV or printing from a laptop on the main network may stop working when the TV or printer sits on the guest SSID.
Guest network vs. similar terms
- Guest network vs. Windows Guest account: the Guest account is a local operating system account that should stay disabled. It has nothing to do with Wi-Fi.
- Guest network vs. hidden SSID: hiding an SSID only stops it from appearing in network lists. It isolates nothing.
- Guest network vs. screened subnet (DMZ): a screened subnet holds internet-facing servers between firewalls; a guest network holds untrusted clients. Both are forms of segmentation.
Guest network on the CompTIA A+ exam
Guest access is part of Core 2 (220-1202) objective 2.10, securing SOHO wireless and wired networks. If a coffee shop wants customers online while its point-of-sale terminals stay private, the answer is a guest SSID with LAN access blocked and client isolation on. If contractors need Wi-Fi for one day without learning the staff password, use a guest network with its own password and a time limit. If visitors on the guest Wi-Fi can browse shared folders, isolation is turned off. If an option claims a captive portal encrypts guest traffic, it is wrong.