Guides · About 1–2 hours · Pew Tech draft

Separate guest Wi‑Fi from staff / office

Guests, kids’ ministry tablets, and streaming phones should not sit on the same Wi‑Fi as office PCs, church email laptops, or giving kiosks. Isolation limits how far a compromised phone can reach.

Target outcome: at least two Wi‑Fi networks (SSIDs)—Staff/Office and Guest— on separate network segments (VLANs when your gear supports it), with guests blocked from talking to office devices. Prefer WPA2 or WPA3; change default admin passwords; keep firmware updated. CISA’s wireless guidance covers guest accounts, encryption, and default passwords: Securing Wireless Networks (CISA).

Vendor-neutral design (do this on any brand)

  1. Inventory. List what must reach printers, NAS, cameras, or office PCs (usually staff only). Guests need internet only.
  2. Two SSIDs minimum. Example names: Church-Staff (password rotated / known only to staff) and Church-Guest (posted password or captive portal).
  3. Separate LAN / VLAN. Put Guest on a different subnet from Staff (e.g. Staff 192.168.10.x, Guest 192.168.50.x). Firewall: Guest → Internet allow; Guest → Staff deny.
  4. Client isolation on Guest. Guests should not see each other’s devices (stops casual snooping on the guest SSID).
  5. Encrypt. Use WPA2-Personal or WPA3-Personal at minimum. CISA advises WPA3 when equipment supports it, and against leaving open/unencrypted hotspots for sensitive use (CISA).
  6. Change defaults. Router/controller admin password, and don’t leave the SSID as the factory name that advertises your hardware model (CISA).
  7. Optional but helpful: rate-limit guest bandwidth so livestream/AV isn’t starved on Sunday; turn guest Wi‑Fi off overnight if your controller allows a schedule.
  8. Keep AV / streaming on Staff or a third “Media” VLAN if you can—never on Guest.

Example A: Ubiquiti UniFi (common in churches)

UniFi’s Network application lets you create separate Wi‑Fi networks and (with a UniFi gateway/switch) separate networks/VLANs, guest policies, and client isolation. Official how-tos live on Ubiquiti Help (article titles such as guest network setup and network isolation)—open Help from your UniFi console or browse help.ui.com while signed into your controller. Note: automated fetches of help.ui.com returned HTTP 403 from this draft environment; use the in-app Help links if the public URL is blocked.

  1. In UniFi Network: create a new Network (or VLAN) for Guests—different subnet from LAN/Staff.
  2. Create a WiFi SSID for Guests; assign it to that Guest network.
  3. Enable Guest Network / hotspot features as offered (client isolation / guest policy) so guests cannot reach LAN devices.
  4. Create a Staff WiFi on the corporate/LAN network; use a strong passphrase; do not post it in the foyer.
  5. Firewall / traffic rules: confirm Guest cannot initiate connections to Staff VLAN (default guest policies usually do this—verify with a phone on Guest trying to open an office printer IP; it should fail).
  6. Update UniFi OS / Network application and AP firmware from the controller before Sunday.

Example B: TP-Link Omada

Omada SDN centrally manages EAPs, switches, and gateways (VLAN, ACL, portal, etc.). Overview: Omada SDN and FAQ context: Omada SDN FAQ.

  1. In Omada Controller: create a LAN / VLAN for guests (unique VLAN ID and subnet).
  2. Create a Wireless Network (SSID) bound to that guest VLAN; enable guest network / portal options your site uses.
  3. Add ACL / gateway firewall rules: Guest VLAN → WAN allow; Guest VLAN → Staff VLAN deny.
  4. Enable AP isolation / client isolation on the guest SSID if available on your EAP model.
  5. Staff SSID stays on the office VLAN; printers and office PCs stay there only.
  6. Apply config to EAPs; test from a phone on Guest (internet works; office file share IP does not).

Sunday morning test checklist

BYOD note: Volunteers’ personal phones on Guest should be the default. Staff devices that hold church email or member data belong on Staff. NIST discusses risks of unmanaged devices accessing enterprise resources in NIST SP 800-46 Rev. 2 (telework / remote access / BYOD security).

Menu names move between UniFi/Omada versions. Prefer your controller’s current Help over this page when labels differ. Educational only—not a network design contract.