Providing internet access for office visitors or home guests is not just a matter of convenience, but also a critical task for ensuring the security of your core infrastructure. Guest WiFi network in the Ubiquiti ecosystem, you can separate visitor traffic from corporate data, limit speed, and even create a stylish login portal. Modern controllers UniFi Network provide flexible tools for implementing any scenario, from a simple password to complex SMS authorization.
Unlike standard home routers, where guest access is often limited to basic functionality, Ubiquiti equipment gives you full control over access policies. You can customize time intervals, traffic quotas, and even the appearance of the welcome page. The key is proper traffic segmentation., which prevents an attacker or infected guest device from accessing your NAS storage or printers.
In this article, we'll walk through the process of creating and fine-tuning guest access on the UniFi controller. We'll cover security, VLAN configuration, and creating a Hotspot portal. These instructions are valid for the latest software versions. UniFi Network Application, the interface of which may differ slightly depending on the controller firmware version.
⚠️ Attention: The UniFi Controller interface is regularly updated by the developers. Button locations and menu item names may vary depending on the software version installed. If you don't see an option, check the official Ubiquiti documentation for your version.
Architecture planning and security
Before you begin configuring the interface, you need to clearly understand the role the guest network will play in your infrastructure. Network segmentation — This is a fundamental security principle that requires isolating guest traffic from the main traffic. Ideally, guest devices shouldn't be able to see your computers, print servers, or video surveillance systems.
To achieve high-quality insulation, technology is often used VLAN (Virtual Local Area Network)This allows you to logically divide the network on a single piece of physical equipment. If you're using managed switches UniFi Switch and access points UniFi APCreating a separate VLAN for guests is essential. This ensures that even if a guest device is compromised, the main network remains secure.
It's also worth deciding on the authorization method in advance. Will it be a simple password (Pre-Shared Key), an open portal with terms and conditions (Captive Portal), or a voucher system? This determines the load on the controller and the convenience for end users. Cafes and hotels often require integration with external systems or payment gateways, which should also be considered during the planning stage.
Creating a New SSID in UniFi Controller
The setup process begins in the controller's web interface. You need to navigate to the wireless network settings section. In newer interface versions, this is done through the menu. Settings → WiFi, where you need to press the button Create New WiFi NetworkHere you set the basic parameters that will be broadcast by access points.
In the field SSID Enter the network name that users will see, such as "Guest_WiFi" or "Office_Guests." It's important to select the correct security profile. For most cases, WPA2/WPA3 Personal, if a simple password is used, or Open (Open) if you plan to use a Captive Portal. Leaving the network open without authentication is not recommended, as this allows anyone to intercept traffic.
☑️ Check before creating an SSID
Pay special attention to the field Advanced OptionsThis is where important settings are hidden, such as selecting a specific device group or limiting signal strength. If you have multiple access points, ensure the network is enabled on all required devices or device groups. You can also configure support for older Wi-Fi standards here, although this is rarely a critical requirement for a guest network.
Setting up Isolation and VLANs
After creating the base SSID, you need to proceed to setting up isolation. In the wireless network settings section, find the option Client Device Isolation (or "Block Intra-SSID Traffic"). Enabling this feature prevents devices connected to the same guest network from communicating with each other. This prevents the spread of viruses within the guest segment and protects users from each other.
For deeper isolation, especially in a corporate environment, the assignment of a separate VLAN IDIn the SSID settings, in the "Network" field, select "Create New" or select an existing guest VLAN. This will require appropriate configuration on the switches and router (e.g. UniFi Gateway or a third-party router) so that traffic with this tag is correctly routed to the Internet, bypassing the local network.
| Parameter | Recommended value | Description of influence |
|---|---|---|
| Client Device Isolation | Enabled | Prevents data exchange between guests |
| Access Control | Pre-Authorization Access | Allows access to DNS and portal only |
| VLAN ID | Separate ID (eg 20) | Logical traffic separation at L2 level |
| Minimum Data Rate | 12 Mbps (optional) | Cuts off very old and slow devices |
Don't forget to check your firewall settings (Firewall Rules) if you are using a gateway. UniFi Dream Machine or USG/UXGBy default, rules may allow access from the guest network to the main network. You need to create a rule DWAN_IN or LAN_IN, which explicitly blocks traffic from the guest VLAN to the main one, allowing only response packets (Established/Related) and Internet access.
Setting up Hotspot and Captive Portal
For public places, a simple password can be inconvenient or unsafe. In this case, a password can be set up Captive PortalThis is the page that opens automatically when you try to access the internet. In the UniFi Controller, this is configured in the Settings → WiFi → Edit Network → Advanced Options → Guest Control.
Here you can choose the authorization type: "Simple Password," "Voucher," "Facebook Wi-Fi," or "No Authentication" (terms and conditions only). For cafes, the "Simple Password" option is popular, where the user enters a code valid for a set period of time. For hotels or coworking spaces, the system is ideal. Voucher, which allows you to generate one-time codes with a time or traffic limit.
⚠️ Attention: When using Facebook Wi-Fi or other external authentication providers, ensure your UniFi controller has direct internet access and the necessary ports are open to communicate with the social network's servers.
The portal's appearance is also customizable. You can upload your company logo, change the background image, and change the colors to match your establishment's branding. In the section Settings → Branding Graphic elements are uploaded and then applied to all access points in the selected group. This creates a professional impression for guests.
Speed limiting and traffic management
To prevent guests from consuming your entire bandwidth, leaving employees without internet, you need to set up speed limits. In UniFi, this is accomplished by creating profiles. Traffic Rules or directly in the guest network settings. Go to Settings → Profiles → Traffic Rules and create a new Rate Limit rule.
Specify the maximum download and upload speeds in Mbps. For example, setting a limit of 10 Mbps per device will allow comfortable web browsing and instant messaging, but will prevent torrents or 4K video streaming, preserving the bandwidth for business tasks.
The nuances of speed limits
The limit applies per device (Per User), not to the entire network. This means that if you have 100 guests connecting, they could theoretically consume the entire bandwidth unless global limits are configured at the gateway level.
After creating a speed limit profile, apply it to the guest network. In the SSID settings, under Advanced Options, find "Traffic Rules" or "Speed Limit" and select the profile you created. You can also configure traffic prioritization, although for a guest network, this typically means no priority compared to critical traffic.
Client monitoring and management
Once you've launched your guest network, it's important to be able to monitor activity. In the section Clients The UniFi controller displays all connected users. You can filter by network (SSID), view the amount of data transferred, the connection time, and the device type. This helps identify anomalies, such as if one device is generating suspiciously high traffic.
Use the blocking feature to manage access in real time. If you notice suspicious activity, you can instantly block the client (Block) or disconnect it (Disconnect). The "Forget" feature also removes the device from the known list, forcing it to re-authenticate the next time it connects.
For advanced monitoring, you can set up email alerts. In the section Settings → Alerts Enable notifications about new device connections or traffic limits exceeded. This will allow the administrator to stay informed without having to keep the controller interface open.
Frequently Asked Questions (FAQ)
Is it possible to set up a guest network without a dedicated VLAN?
Yes, it is possible. You can create a guest network in the same VLAN as the main network, but be sure to enable the option. Client Device Isolation and configure firewall rules to prevent access from the guest subnet to the main one. However, using a separate VLAN is a more secure and professional approach.
How to change the validity period of a voucher?
The voucher validity period is configured in the vouchers profile. Go to Settings → Hotspot (or depending on the version, in the guest access settings), create a new voucher profile and specify the duration in minutes, hours, or days. Then, select this profile when generating codes.
Why can't guests see the login page?
The most common issue is HTTPS. Modern browsers block redirects to the authorization portal if the site uses a secure connection. Make sure the "Pre-Authorization Access" option is enabled in the Guest Control settings and the required domains are allowed. Also, try opening any HTTP site (for example, neverssl.com) to initiate the transition.
Does a guest network slow down my main WiFi?
Yes, because all devices share the same radio spectrum. Even with limited internet speeds, a large number of guest devices creates noise and wastes airtime. It is recommended to dedicate the guest network to a separate frequency (for example, only 2.4 GHz for guests, leaving 5 GHz for business) or use separate access points for guests.