Give visitors internet access with a guest Wi-Fi network

TL;DR — The safest common way to give a visitor internet access without exposing your main network is to use a separate guest Wi-Fi network with client isolation (blocks guest devices from talking to your devices). In your router or access point dashboard, create a guest SSID, set WPA2/WPA3 security, turn on "isolation" or "access intranet: off," and test that a guest device can browse the web but cannot open your printer or NAS. Reading time: ~5 min

Goal

When you finish, visitors will be able to join a dedicated guest Wi-Fi network and use the internet, while devices on that guest network cannot reach your main Wi-Fi devices, printers, file shares, or router admin page.

Prerequisites

• Your router or Wi-Fi access point admin login
• Permission to change Wi-Fi settings on that device
• A phone or laptop you can use as a test "guest" device
• The name of your current main Wi-Fi network so you do not rename or edit the wrong one
• If your setup has separate gear: access to both your router and your Wi-Fi controller/dashboard
• Optional for advanced verification: a computer on your main network and its IP address (internet protocol address, the device number on your network), checked with:

ipconfig

on Windows, or:

ip addr

on macOS/Linux

Steps

Step 1: Sign in to your router or Wi-Fi dashboard

Open your network device dashboard in a browser. Common local addresses are:

http://192.168.1.1
http://192.168.0.1
http://10.0.0.1

If your provider uses a cloud dashboard, open that instead. In many dashboards the path is one of these:

• Wi-Fi → Guest Network
• Wireless → Guest Wi-Fi
• Network → SSIDs → Add SSID
• In your provider's dashboard (e.g. Cloud-managed Wi-Fi): Wi-Fi or Wireless → Networks

What you should see when this succeeds: a page that lists your current Wi-Fi networks or an option named Guest, Guest Network, or Add SSID.

Step 2: Create a separate guest Wi-Fi name

In the guest network screen, enter these literal values unless you already have a naming standard:

• Network name / SSID: Guest
• Broadcast SSID: On
• Band: 2.4 GHz and 5 GHz if offered, otherwise leave the default
• Schedule: Always on

If your dashboard uses an "Add SSID" form, use:

• Name: Guest
• Usage/VLAN/Profile: Guest if that option exists

What you should see when this succeeds: a new Wi-Fi network named Guest appears in the list of wireless networks.

Step 3: Set a password and security type

On the same guest network form, set these values:

• Security: WPA2-Personal or WPA2/WPA3-Personal if both are offered
• Password: create a new password just for guests, for example:

AgencyGuest2026!

• Hidden network: Off

Do not reuse your main Wi-Fi password.

What you should see when this succeeds: the guest network shows as secured/locked, with WPA2 or WPA2/WPA3 enabled.

Step 4: Turn on guest isolation

This is the setting that stops guest devices from reaching your internal devices. The name varies by vendor. Turn on the option that matches your dashboard:

• AP Isolation: On
• Client Isolation: On
• Guest Isolation: On
• Block access to local network: On
• Access Intranet: Off
• Allow guests to see each other: Off
• Allow access to LAN: Off

If your dashboard has a checkbox list, the safe pattern is:

• Internet access: On
• Local network / LAN access: Off
• Intranet access: Off
• Client-to-client access: Off

What you should see when this succeeds: the guest network details show isolation enabled, or local/LAN/intranet access disabled.

Step 5: Block guest access to the router admin page if the option exists

Some routers include a separate toggle for management access from guest Wi-Fi. Set it to:

• Allow guests to access router settings: Off
• Management from wireless guest network: Off
• Access to gateway/admin page: Off

If your dashboard has no such option, continue; many devices block this automatically when guest isolation is enabled.

What you should see when this succeeds: the management access setting shows Off or Disabled for the guest network.

Step 6: Save or apply the changes

Use the exact button shown in your dashboard, usually one of:

• Save
• Apply
• Update
• Provision

Wait for the Wi-Fi device to finish applying changes. This often takes 30-90 seconds.

What you should see when this succeeds: the dashboard returns to the Wi-Fi list and the new Guest network shows as enabled.

Step 7: Join the guest network from a test device

On your phone or laptop, open Wi-Fi settings and connect to:

SSID: Guest
Password: AgencyGuest2026!

If your device asks whether this is a private or trusted network, choose the less-trusting option if available.

What you should see when this succeeds: the device shows connected to Guest and loads a public website.

Step 8: Test that guests cannot reach your internal network

From the guest device, first confirm internet access by opening a public site such as:

https://example.com

Then try to open common local addresses in a browser:

http://192.168.1.1
http://192.168.0.1
http://10.0.0.1

If you know the IP address of a printer, NAS, or computer on your main network, try to open it too.

What you should see when this succeeds: public websites load, but local IP addresses fail to load, time out, or show access denied.

Verify it works

Use this end-to-end checklist:

1. On a guest device connected to Guest, open a public website.
   • Expected result: the site loads normally.
2. On the same guest device, try these local addresses:

http://192.168.1.1
http://192.168.0.1
http://10.0.0.1

• Expected result: they do not open the router admin page.

1. If you have a printer or NAS on the main network, try its local IP from the guest device.
   • Expected result: it does not respond.
2. If you have a computer on the main network, note its IP and from the guest device try:

ping 192.168.1.50

Replace 192.168.1.50 with the real IP.

• Expected result: request timed out, destination unreachable, or no reply.

A simple traffic view looks like this:

[Guest Device] ---- 1. web traffic ----> [Internet]
     |
     | 2. blocked to LAN
     v
[Main Network Devices]

Common pitfalls

Guest network created, but LAN access left on

Mistake: You created a second SSID but did not enable Client Isolation, AP Isolation, or Block access to local network.

Symptom: Visitors can browse the internet and can also see printers, TVs, file shares, or the router page.

Fix: Go back to the guest network settings and set Client Isolation: On and LAN/Intranet access: Off.

Reusing the main Wi-Fi instead of creating a true guest SSID

Mistake: You changed the password on your main Wi-Fi and gave that to the visitor.

Symptom: The visitor has full network access, exactly like staff or family devices.

Fix: In the dashboard, create a separate SSID named Guest and give that password out instead.

"Guest portal" enabled by accident

Mistake: You turned on a captive portal (login/splash page) without intending to.

Symptom: Devices connect to Wi-Fi but cannot browse until they accept terms or enter details.

Fix: In Guest Network or Portal settings, set Captive Portal: Off unless you specifically want a sign-in page.

Testing from a device that is still on the main network

Mistake: Your phone auto-rejoined the main SSID instead of the guest SSID.

Symptom: Internal devices still open during testing, so it looks like guest isolation failed.

Fix: On the test device, open Wi-Fi settings and confirm the connected SSID is exactly Guest before testing.

Old DHCP lease or cached network state

Mistake: A laptop keeps old network details after you changed guest settings.

Symptom: The device connects inconsistently or still reaches resources it should not.

Fix: Forget the Guest network on the device, reconnect, and test again.

Multiple Wi-Fi devices, but the change was made in the wrong place

Mistake: You edited the router, but Wi-Fi is actually provided by separate access points or a controller.

Symptom: The guest SSID never appears, or appears on only one part of the building.

Fix: Open the dashboard that manages the Wi-Fi radios/access points and create the guest SSID there, then apply/provision the change to all access points.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.