Why Your Guest Wi-Fi Can Probably Reach Your Server
A separate guest network name feels like separation. Often it isn't — it's a second label on the same network as your file server, printers and cameras. Here's how to tell, and how to fix it.
Most small offices have two Wi-Fi networks: one for staff and one called something like Guest. That feels like separation. Frequently, it’s just two names for the same network.
Why this matters
Wireless is the one part of your network that reaches past your walls. Someone in the parking lot, the unit next door, or the floor above is inside radio range. And on a flat network, anyone who joins — a guest, a contractor, a former employee who kept the password — can reach everything: the file server, the printers, the security cameras, the accounting system.
Check yours in five minutes
Connect a laptop to your guest network, then try to reach something that should be private:
- The address of your file server or NAS
- A network printer’s web page
- Your router or firewall admin page
- A security camera or door system
If any of those respond, your guest network isn’t separated. A proper guest network reaches the internet and nothing else.
What real segmentation looks like
Segmentation means splitting the network into zones that are enforced at the network layer — not just given different names:
- Staff — laptops and phones that need internal resources
- Guests — internet only, with devices isolated from each other
- Payment — card terminals, kept apart from everything
- Smart devices — cameras, thermostats, TVs, which are rarely patched
- Servers — reachable only from the zones that genuinely need them
The rules between zones are the important part. Guests can’t reach staff. Smart devices can’t reach servers. Payment terminals talk only to the payment processor.
The shared password problem
A single Wi-Fi password that everyone knows can’t be revoked for one person. Every visitor, contractor and former employee who ever had it still has it.
For staff, individual credentials or certificate-based authentication fix this: when someone leaves, you remove their access without changing anything for anyone else. It also defends against evil twin attacks, where an attacker broadcasts a network with your network’s name.
Poor coverage is a security problem too
When Wi-Fi doesn’t reach the back office or the warehouse, someone eventually plugs in their own router. That router is now an unmanaged, unmonitored entry point. Fixing coverage properly removes the reason for it.
We describe a typical case in our guest Wi-Fi can reach the file server. Design and testing are covered in our wireless and networks practice.
- Wi-Fi
- Network Security
- Segmentation