How to set up a secure guest Wi-Fi network at work

Why is sharing the password with customers risky?

In many cafes, stores and waiting rooms, the wireless network password is written on the wall or next to the register. This password is often the password of the business's own network. That means the customer's phone is on the same network as the computer at the register, the POS device, the printer and the camera recorder.

There are two problems with this setup. The first is security: any device on the network can scan the other devices on the same network. A camera recorder or printer whose default password has not been changed is exposed to everyone who joins the network. A customer's phone infected with malware can also run the same scan without knowing it. The second is performance: when customers watch video on a busy afternoon, payments at the register slow down.

The solution is to put guests on a separate network. When this separation is done properly, the customer gets onto the internet but cannot see any of the business's devices.

How is the network separated?

The simplest method is to turn on the guest network feature of the modem or access point. This feature, found even on home-type devices, creates a separate network name and blocks guests' access to the internal network. It can be enough as a start for a small shop.

A more robust method is using VLANs. A VLAN means creating virtual networks that cannot see each other over the same cables and devices. The staff network, guest network and camera network run on separate VLANs. A router or firewall controls traffic between them. This setup needs a router that supports VLANs, a managed switch and access points that can broadcast more than one network name.

Client isolation should also be turned on for the guest network. This setting prevents phones on the same guest network from seeing each other. That way, someone at the next table in a cafe is stopped from trying to reach your phone.

Expert note: After installation, connect to the guest network with a phone and try to reach the IP address of the register computer or the camera recorder. If you can reach it, the separation is not working.

Speed limit and usage time

Putting a total and a per-person speed limit on the guest network protects the part of the internet line set aside for the business. The register, the payment system and remote viewing of the camera system must work under all conditions. Giving the guest network only part of the line strikes this balance.

A usage time limit is also useful. After a customer logs in, they can stay connected for a set time, then they must log in again. This also filters out vehicles parked in front of the door and neighboring shops that use the network for hours.

Do not leave the guest password fixed either. A password that stays the same for months is saved on the phone of everyone on the street. Giving a password that changes weekly or monthly on a small card at the register, or printing a one-time code under the receipt for each customer, solves this problem.

Is a login page (captive portal) needed?

The login page is the screen a person connecting to the guest network sees before getting on the internet. It is common in hotels and shopping centers. The user can be asked for a phone number and an SMS code, a room number, or a coupon code given at the register.

A login page is a practical way to record who connected and at what time. It also lets you have the terms of use accepted. But if you collect personal data such as a phone number, the Personal Data Protection Law No. 6698 comes into play: the user must be given a privacy notice, and it must state how long and for what purpose the data will be kept. Get support from a legal advisor in preparing this notice.

Law No. 5651 and record keeping

Law No. 5651 and the regulation tied to it define places that offer internet access collectively as mass-use providers. Cafes, restaurants, hotels, dormitories and similar businesses may be considered within this scope and are expected to keep access logs in a set manner. Which information is stored, by what method and for how long is described in the legislation and may change over time.

On the technical side, these records are often kept automatically by the firewall or a logging device. The records must be stored so that they cannot be altered and must be available to the authorized authorities when needed. We recommend that you clarify with a legal advisor whether your own business is covered and what the current conditions are.

Short checklist for installation

When setting up guest Wi-Fi or reviewing an existing network, check the items below one by one.

• The guest network is broadcast under a different network name from the staff network.
• Business devices cannot be reached from the guest network.
• Guest devices cannot see each other.
• There is a per-person and a total speed limit.
• The guest password changes at regular intervals.
• Admin passwords are not the default values.
• Access logs are kept and stored.
• If personal data is collected, a privacy notice is displayed.

Which setup for which business?

For a clinic with a waiting room or a small store, the modem's guest network feature and regular password changes are often enough. Cafes, restaurants and busy stores need a setup with VLANs, speed limits and a logging device. In hotels, dormitories and shopping areas, a login page, centrally managed access points and a logging system are planned together. In places that get crowded in season, such as tourist businesses around Balıklıgöl in Şanlıurfa, the load in summer is very different from winter; capacity should be calculated for the busy period.

Desa Bilişim sets up the structure that separates the guest network from the staff and camera networks in businesses, and hands it over with the settings documented. If you want to find out how open your current network is, we can start with an on-site check.

Frequently asked