UniFi guest WiFi: how to test separation from your business network
UniFi guest WiFi for Swiss SMEs: understand VLANs, firewall and client isolation, then check the result with a practical acceptance test.
A visitor joins your guest WiFi, opens a website and starts working. That confirms internet access, but it does not show whether internal printers, files or network management are also reachable. An acceptance test should answer two questions: what must work for guests, and what must remain blocked?
A WiFi name needs an appropriate network
The visible WiFi name is an SSID. UniFi Network can associate it with a network or VLAN. A VLAN creates a logically separate network area on shared infrastructure. Connections between the access point, switch and gateway must carry the assigned VLAN throughout the path. Creating WiFi SSIDs
A second name such as Company-Guest is therefore only a starting point. Define which network guests belong to and how its connections are controlled. A VLAN alone does not decide whether access to another VLAN is permitted.
Three places contribute to isolation
| Location | Function | Purpose |
|---|---|---|
| Gateway | Network Isolation or specific firewall rules | Restrict connections between network areas |
| Access point | Client Device Isolation | Block direct communication between wireless devices on that access point |
| Supported switch | Device Isolation using ACLs | Restrict communication between devices within the same VLAN at switch level |
These functions complement each other. Isolation at one access point does not by itself prove that guests connected through different access points cannot communicate. Network and client isolation
Check existing hardware as well: not every switch supports ACLs. Ubiquiti’s exclusions include integrated switch ports on UniFi Gateways and In-Wall access points. This is relevant to small installations with devices connected directly to the gateway. Switches and ACLs
Protect management access while keeping required services
UniFi’s zone-based firewall groups networks into zones. The Gateway zone also includes traffic addressed to the gateway itself, such as address assignment, name resolution and administration. Blocking that zone indiscriminately can therefore affect DHCP and DNS. Rules can cover IPv4, IPv6 or both. Zone-based firewalls
Define the requirement in terms of outcomes: guests obtain an address, resolve names and use the intended internet services, while internal applications and administrative interfaces stay inaccessible. Any necessary exceptions depend on the services in use. If both IP versions are deployed, test both.
Planning example: reception and a meeting room
Imagine an office with one access point at reception and another in a meeting room, connected through a switch. Staff use an internal network with a file store and printer. Guests use a separate network with internet access.
This is an illustrative planning scenario, not an Irontec customer reference or a recommendation for a particular access point count.
Agree the following outcomes before implementation:
- Visitors can use websites and required meeting services.
- Internal file storage, printers and device administration are blocked.
- Guests cannot establish direct connections to each other.
- The staff network continues to support its agreed applications.
These outcomes provide a more useful acceptance checklist than confirming that an isolation checkbox is enabled.
An acceptance test with verifiable results
Use two test devices you control and explicitly authorised test destinations. Establish which application or service should respond at each destination. Confirm that it works from an authorised internal connection first: an offline computer must not be mistaken for a successfully blocked connection.
Ensure the test traffic really uses guest WiFi. Disable or account for mobile-data fallback and other alternative paths that could distort the result.
| Test in this example | Expected result |
|---|---|
| Join guest WiFi and check network assignment | The device receives the intended guest configuration |
| Open a public website and use the required meeting application | Both work after any required login |
| Access an authorised internal test service directly by IP address | The connection from the guest network is blocked |
| Open a known internal management interface | Administration is inaccessible from the guest network |
| Connect both test devices to the same access point | The agreed test service on the other device is inaccessible |
| Connect one device at reception and one in the meeting room | Isolation also holds across different access points |
| If provided, connect a device to a guest Ethernet socket | The same agreed restrictions apply |
| Recheck an internal workstation | Its intended internal applications still work |
A failed ping is not sufficient evidence on its own. A local device firewall or a stopped service can also prevent a reply. Use known services, verify their initial working state and compare unexpected results with the relevant rules. Test direct IP access as well as names so that failed name resolution does not conceal an unintended permission.
Run the relevant checks for IPv4 and, where used, IPv6. Record untested or unused variants explicitly. A passed test applies to the documented paths and configuration; it is not a blanket security guarantee.
Does your guest access need a login page?
A captive portal is a page visitors may see before obtaining internet access. UniFi supports options including passwords and vouchers, with settings such as expiry and usage limits. Hotspots and captive portals
Choose according to your reception process. Frequent visitors have different needs from an occasionally used meeting room. Test both a fresh login and the resulting access permissions. Successful authentication alone does not prove isolation.
Ubiquiti treats the portal as optional alongside network and client isolation. Its recommendations also discuss optional speed limits for sharing available bandwidth. Guest WiFi best practices
Keep the result in the operating documentation
Record the date, devices, software versions, network assignments and expected versus actual results. Assign an owner and a target date to unresolved points. Repeat relevant checks after switch replacements, firewall changes or guest-network extensions.
Irontec supports UniFi WiFi planning, switching and UniFi firewalls. A network diagram, device list and description of permitted guest use help with the initial assessment. Existing installations can also be assessed through IT support.
Official Ubiquiti sources linked throughout were checked on 29 September 2026. The test scenario is an editorial example and contains no claimed customer measurements.