One Network, Everyone In: Does Your Guest Wi-Fi Actually Separate Anything?

Most small UK offices have a guest Wi-Fi network. Far fewer have a guest network that is actually separate from everything else. The difference matters, and it is usually invisible until something goes wrong.

A flat network is the default in a lot of small firms. One router, one password, one big happy family of laptops, printers, phones, the smart TV in the meeting room and whatever a visitor brought in on Tuesday. It works. It is also the networking equivalent of leaving every internal door unlocked because the front door has a sign on it.

This is not a demand for an enterprise networking project. It is a 45-minute check you can run with the kit you already have, followed by a clear list of fixes to ask your IT support provider to make and document.

Why a separate Wi-Fi name is not a separate network

Creating a guest SSID takes about two minutes on most routers. It gives visitors a different name and password. It does not, by itself, stop their devices from reaching your file server, printer, CCTV recorder or the router's admin page.

Proper segregation usually means a separate VLAN or subnet, firewall rules that block guest traffic from the main office network, and client isolation so guest devices cannot talk to each other. Some routers call this "guest network" and mean it. Others call it that and simply hand out the same network with a different label.

For a small firm, the risk is less about spies in the reception area and more about ordinary contamination. A visitor's laptop with an old infection, a cheap smart plug with default credentials, a printer that has not been updated since the last government, or a staff member who joined the guest network because the main one was slow. Once one device is on the same network as everything else, lateral movement gets easier.

It also comes up in cyber insurance questionnaires. Insurers increasingly ask whether guest and corporate networks are separated. "We have a guest Wi-Fi" is not the same answer as "yes, and here is the evidence."

The 45-minute check

You do not need to be a network engineer. You need a laptop, a phone, access to the router or firewall admin page if you have it, and a willingness to write down what you find.

1. Make a quick device map

List the networks you can see in the office: staff Wi-Fi, guest Wi-Fi, wired network, any separate network for CCTV or card machines. Then list the things connected: staff laptops, phones, printers, NAS boxes, tills, smart speakers, door access, the lot.

You are looking for the awkward residents. The printer that everyone uses but nobody owns. The smart TV on the staff network because that was easier. The old PC in the stockroom that runs the label printer. These are the devices that make segregation messy in real small offices.

2. Compare IP addresses

Connect a laptop or phone to the staff Wi-Fi and check its IP address. On Windows, open Command Prompt and type ipconfig. On a Mac, use System Settings or ifconfig. On a phone, look in the Wi-Fi details.

Then connect to the guest Wi-Fi and check again. If both networks hand out addresses in the same range — for example, both are 192.168.1.x — that is a strong hint they are not separate. If the guest network uses a different range and you cannot reach office devices, that is a good sign, but it is not the whole story.

Ask your IT support provider for the DHCP ranges for each network and add them to your notes. "Different Wi-Fi name, same address range" is a useful sentence to have ready.

3. Try to reach something you shouldn't

From a device on the guest Wi-Fi, try the obvious things. Can you open the printer's web page? Can you reach the router admin page? Can you see a shared folder or NAS dashboard? Do not run any aggressive scanning tools. Just try the addresses you already know.

If a guest device can open the router login page or the printer's admin interface, the guest network is not doing much separating. If it can reach file shares, it is definitely not.

4. Check whether guest devices can see each other

Connect two devices to the guest Wi-Fi and see whether one can ping or browse to the other. Many routers have a "client isolation" or "AP isolation" setting that blocks this. It is worth checking because a visitor's infected phone should not be able to chat to another visitor's laptop on your premises.

5. Look at the admin side

Check who can log into the router or firewall. Is the admin password still the default? Is remote management switched on when nobody needs it? Is the firmware up to date? These are basic hygiene points, but they matter more when the guest network and the staff network are effectively the same place.

Write down what you find in a simple table: network name, address range, what it can reach, what it should reach. That table is worth more than a vague memory of how the office was set up in 2023.

What to ask IT support to fix

Once you have your notes, ask for a short, specific piece of work. The request is not "make us secure". It is "separate guest Wi-Fi from the office network and document it".

A sensible list looks like this:

• Put guest Wi-Fi on its own VLAN or subnet, separate from staff devices and servers.
• Add firewall rules so guest traffic can reach the internet and DNS, but not the office network.
• Turn on client isolation for guest devices where the kit supports it.
• Keep printers, NAS boxes, CCTV and smart devices on the network they belong on — not on guest Wi-Fi because it was convenient.
• Change default admin passwords, switch off remote management unless it is needed, and check firmware.
• Give you a one-page diagram and a short written record of the rules.

That last point is the one small firms skip. If the setup is not written down, the next person to touch the router will guess. A one-page document with the network names, address ranges and what is allowed to talk to what is enough.

The bit people get wrong

Segregation is not about making life difficult for staff. It is about stopping the guest network from becoming the office network with a different name. If your team is using guest Wi-Fi to print because the staff Wi-Fi is flaky, that is a support problem to fix, not a networking policy to enforce with a clipboard.

And do not turn this into a weekend project. For most small UK offices, the sensible version is a modest router or firewall with proper guest rules, a clear diagram, and a quarterly check that the guest network still behaves as expected.

Forty-five minutes now is cheaper than explaining later why a visitor's laptop could see the finance share. If you are not sure what your current setup is doing, start with the IP address check. It is not glamorous, but it tells you more than the Wi-Fi name ever will.