Blog / how-to
Setting up guest Wi-Fi on UniFi properly
How to build a guest network on UniFi that gives visitors internet and nothing else: isolation, bandwidth limits, and the portal question.
By the end of this post you will have a guest network that hands visitors working internet and absolutely nothing else: no view of your NAS, your cameras, your printers or each other. This is for anyone running UniFi at home or in a small business who is currently sharing their main Wi-Fi password with whoever asks.
That last part is the actual problem. Every password you hand out is a device you do not control sitting on the same network as everything you care about. A guest network fixes that structurally, and on UniFi it takes about twenty minutes. As always with UniFi, menus shift between versions, so treat my paths as directions and the concepts as the map.
Decide what "guest" means for you
Before touching settings, answer two questions.
First, who is this for? Actual house guests, customers in a waiting room, or contractors' laptops that show up for a week? The stakes rise in that order, and so does the value of doing this properly.
Second, do you want a captive portal (the branded "accept the terms" page) or just a password? For a home, a portal is theatre; skip it. For a business, a simple portal with your name on it looks professional and gives you a spot for terms of use. What I talk most people out of is the elaborate voucher system: unless you are a café rationing bandwidth by the hour, vouchers are a chore you will abandon by March.
Create the guest network
In the UniFi Network application, go to Settings, then Networks, and create a new virtual network. Name it Guest, give it its own VLAN ID (I covered VLAN planning in the VLAN setup guide, and this network slots straight into that scheme) and let UniFi run DHCP for it.
The setting that matters here is the network type or isolation option: mark it as a guest network, or turn isolation on. That single choice is what blocks traffic from the guest network into your other networks. On recent versions the guest designation also enables client-to-client isolation, so one visitor's laptop cannot poke at another's.
Create the SSID
Go to Settings, then WiFi, and add a new wireless network. Attach it to the Guest network you just made. A few choices worth getting right:
- Name it plainly. "SmithHouse Guest" or "YourBusiness Guest". Cute names confuse visitors and help nobody.
- Use a password anyway, even with a portal. An open network is an invitation to the whole parking lot. WPA2/WPA3 with a simple phrase you can say out loud is fine; this password protects nothing except your bandwidth.
- Band and visibility. Let it broadcast on both bands and leave the fancy toggles alone. Guest traffic does not need fast roaming tuned.
Limit the bandwidth
This is the step everyone skips and then regrets the first time a visitor's phone decides to back up three months of video. Set a bandwidth profile or speed limit on the guest network: for most homes and offices, capping guests somewhere around 20 to 50 Mbps down keeps them comfortable while making it impossible for them to flatten your connection. UniFi lets you set this per network or per client depending on version; either works.
The portal, if you want one
For businesses: enable the hotspot/portal option on the guest SSID, add your business name and logo, and use simple password authentication. Test it from a phone with Wi-Fi assist turned off, because the portal page not loading is the most common guest-Wi-Fi complaint there is, and it is usually the phone silently falling back to cellular.
Test it like a guest
Join the guest network with your own phone and try to do the wrong things. Browse to your NAS's address: it should time out. Look for the office printer: it should not appear. Run a speed test: it should hit your cap and stop. Then do the one right thing and confirm normal websites load quickly. If your main devices can see the guest devices but not the other way around, check whether your isolation rule is one-directional; for guests you generally want no traffic in either direction.
Where it gets harder
Shared printers that guests legitimately need, a smart TV in a rental unit, event spaces with a hundred simultaneous visitors, or anything where guest traffic must be logged for liability reasons: that is where a guest network stops being a checkbox and becomes design work. Those setups also need someone keeping an eye on them after the install, which is a different service than a Saturday of settings. If you are somewhere in between and not sure which side you are on, a short second-opinion call sorts it out quickly.