Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the best options out there to be able to provide a guest wireless internet access so they can't see the rest of devices in LAN?, what's the best and also cost effective appliance that will do that?

share|improve this question
up vote 1 down vote accepted

My company is looking into the same issue. Unless I read something better here, we are going with 2 Linksys wireless routers....running DDWRT.

We like to have the public AP auto-disabled during nonbusiness hours as well as blind to our network. It would be totally open, but may have a welcome portal via wifidog (which, thanks to serverfault, I have discovered runs nicely with DDWRT).

The staff router will not broadcast SSID and will use MAC address recognition, be available 24/7 and play nicely with our network.

share|improve this answer
This is a great solution, as soon as you have WRT54G Version 1 to 4 or one of the WRT54GL. Good luck to find some, they're are rare these days... unfortunatly... – Marc-Andre R. Jun 1 '09 at 1:17
@Fox: The WRT54GLs are easy to find (at least in Canada)... we order them from our distributor and sell them reasonably frequently – MikeyB Jun 1 '09 at 1:44
Please tell me that your staff router will have WPA or higher? Because not broadcasting the SSID and MAC filtering will take all of 2 minutes to blow past. – Josh Brower Aug 29 '09 at 0:45

I would strongly suggest putting guests on their own subnet with strictly controlled firewalls preventing anything but internet access.

share|improve this answer

Are you looking to do this through a single wireless router or through multiple access points? Many routers are multi-SSID as well as DMZ capable if that's what you want. I would look around for some higher end SOHO boxes like the one's from DrayTek. I have had good luck with them in the past. If you already have the LAN set up with a separate subnet for the guest network then you would just place an AP on each and name/secure them as desired. Both would do the job for you.

share|improve this answer

The new Apple AirPort Extremes support this.

"Now you can set up a separate Wi-Fi network with a separate password for your visitors. Simply enable the new guest networking feature, and your guests can use the Internet but can't access other parts of your private network, such as your computers, printers, and attached hard drives."

share|improve this answer
does that feature actually work? because I have tried the Belking N1 vision and that was a waste of money, the guest account interfere with the other ssid signal and knocks itself down... – Terumo May 31 '09 at 16:46
I don't have an AirPort Extreme, but I'd expect that a product from Apple does what it's meant to do, or you will atleast be able to return it. The AirPort gear was far ahead of the competition 10 years ago when wireless was just starting to become popular, so I'd have high expectations for this device too. – mlambie Jun 1 '09 at 4:35
Actually, miharp confirms that it works as expected in his/her answer below. – mlambie Jun 1 '09 at 4:36

I have been using the guest network option on a new airport for about a month now and it has worked very well so far.

share|improve this answer

Several companies I know have set up a seperate cheap ADSL connection with a wireless router and this is what is used to provide network access to visitors.

share|improve this answer
This is actually the best way to keep everything secured and most companies won't cry for a 50$ a month connexion... – Marc-Andre R. May 31 '09 at 22:31

You can have a look at one question I asked on Wednesday that might help you too, here the link :

share|improve this answer

Netcomm do a product that provides Layer 2 segregation, effectively running each client in it's own VLAN. It even does an SMTP redirect - very handy if your ISP blocks port 25. Although it's designed as a pay system with tickets, this can just be turned off.

Over here in Oz it's about AUS $1,500

share|improve this answer

I have a DLink DI-655 and one of recent firmware upgrades came with a new feature, 2 Independent Wifi networks on the AP/Router. The second one is a guest network, with a differnet SSID, the ablity to set different security settings (Primary can be WPA2 w/AES [CCMP] only, and the guest can be WPA w/TKIP for legacy laptops). The guest network can be set to only allow internet access (no internal access).

I've seen it for $100 at Costco. I'm sure that you can order it, or something just like it without much trouble (and it does N with a gigabit ethernet). The Linksys model above is now getting out of date, as it is 802.11g system.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.