Who it is for
This is for a small shop that already runs UniFi (a UniFi gateway or console, plus at least one UniFi access point) and wants a separate WiFi name for customers or vendors. Guests should reach the internet. They should not reach the register, staff laptops, printers, or cameras. You do not need a captive portal for this guide. If you have no UniFi gateway and only stand-alone access points, stop — isolation works differently there, and this path assumes UniFi Network with a UniFi-routed guest network.
What you need
- Admin access to UniFi Network (local console or unifi.ui.com).
- At least one UniFi access point already adopted and online.
- An unused VLAN ID (this guide uses 40 as an example — pick any free ID you document).
- A guest subnet that does not overlap your staff LAN (example:
10.40.0.1/24). - A guest WiFi name visitors will recognize (example:
ShopName-Guest) and a long passphrase they can type once.
Before you change anything
- Note your current staff WiFi name and that it still works on a phone you control.
- Make a UniFi backup (Settings → System / Control Plane → Backups — menu labels move slightly between UniFi OS versions).
- Write down the VLAN ID and subnet you will use so you do not reuse a live ID by accident.
Steps
1. Create a Guest network (VLAN)
- Open UniFi Network → Settings → Networks.
- Create a new network. Name it something internal such as
Guest(visitors will not see this label). - Set a VLAN ID that is not already in use (example:
40). - Set a gateway/subnet that does not overlap staff (example:
10.40.0.1/24) and leave DHCP on so guest phones get addresses. - Enable Network Isolation so this VLAN cannot reach your other networks. That is the setting that keeps guests off staff devices across VLANs (Ubiquiti’s guest WiFi best practices).
- Save.
2. Create the guest WiFi name
- Go to Settings → WiFi → Create New.
- Set the WiFi name (SSID) guests will see.
- Under Network, choose the Guest network from step 1. If you skip this, guests land on the wrong VLAN and isolation does not apply.
- Use WPA2/WPA3 Personal (or the current UniFi default that still supports your typical guest phones) and set a long passphrase. Prefer a memorable phrase over a short jumble.
- Broadcast from the APs that cover the public area. Keep the total number of SSIDs small — three or fewer per radio is a practical ceiling.
- Save and wait for the APs to provision.
3. Turn on client isolation
- Open the guest WiFi you just created.
- Enable Client Device Isolation so phones on the same access point cannot talk to each other (isolation overview).
- Optional for a busy waiting room: enable Proxy ARP on that WiFi to cut down broadcast chatter (same best-practices article).
- Optional: set a per-client speed limit so one guest upload cannot saturate the shop uplink. Skip this if your uplink is already quiet.
4. Confirm switch ports can carry the VLAN
UniFi switches usually pass the needed VLANs when uplink ports stay trunked. If you have a third-party switch between the gateway and the AP, that trunk must allow VLAN 40 (or whatever ID you chose). If guests associate but never get DHCP or never reach the internet, check VLAN tagging on that path first (Creating UniFi WiFi SSIDs).
5. Test like a stranger
- On a phone that is not on staff WiFi, join the guest SSID and enter the passphrase.
- Confirm a browser can load a public site.
- Confirm you cannot reach a staff printer IP, a camera, or a file share you know on the staff LAN.
- Confirm staff WiFi still works on a second device.
- Write the guest name and passphrase somewhere the front desk can find without posting them on social media.
Caution
- Do not put guests on the same network as registers or cameras and rely on “they won’t guess the password.” Isolation is a separate network plus the isolation toggles above.
- Device Isolation (ACL) on the network is a switch-level tool. It only applies in the topologies UniFi documents for ACLs. Network Isolation + Client Device Isolation cover most single-gateway small shops; enable ACL only when your gear and layout match Ubiquiti’s notes.
- A captive portal (Hotspot) is optional and not required for a simple passphrase guest SSID. If you enable a portal later, follow Ubiquiti’s Hotspot article — do not leave the SSID open unless you accept that open WiFi has no WPA encryption on the air.
- Menu names drift between UniFi Network versions. If a label moved, search Settings for Network Isolation and Client Device Isolation rather than copying an old screenshot.
Want this done for your office?
The quote is free and human-written, from the engineer who would do the work. Websites are remote-friendly across the US. WiFi, and Apps & AI, are local to Nashua, southern New Hampshire, and northern Massachusetts.
Get a free quote