Networking
Guest WiFi That Stays Separate: VLANs, Isolation and Printer Access
A separate WiFi name is only the start. Map visitors to the right network, define what they can reach and make printing or casting a deliberate, tested exception.
A guest network needs an access policy, not just a different WiFi name. Put visitors on the intended VLAN, control what they can reach at the gateway and apply client isolation where required. If printing or casting is needed, design a specific exception and test it without opening the rest of the office.
A visitor joins the network labelled Guest and can see a shared NAS. At another office, the opposite happens: the guest network is isolated so thoroughly that a visiting trainer cannot print a handout. Both problems start with an incomplete definition of what guests should be able to do.
Write that outcome down first. Internet only? A particular meeting-room display? One reception printer? Then match the wireless, switching and firewall controls to it.
SSID, VLAN, Client Isolation and Firewall Rules Are Different
| Control | Its Job | What It Does Not Establish Alone |
|---|---|---|
| Separate SSID | Gives users a distinct wireless network to join. | That the traffic is separated from staff devices. |
| VLAN and Subnet | Place devices in the intended network segment. | That routing between segments is blocked. |
| Client Isolation | Restricts peer communication within the feature's scope. | Universal isolation across every AP, wired port and routed network. |
| Gateway Firewall or ACL | Controls permitted traffic between routed networks and services. | Protection between peers that communicate directly within one segment. |
An access control list, or ACL, is a set of traffic rules. Its position matters: an AP, switch and gateway may enforce different parts of the policy. A routed rule cannot inspect traffic that never reaches that routing point.
A separate SSID mapped into the staff VLAN can still place guests in the wrong network. Conversely, a correctly separated VLAN can still have an overly broad rule permitting access to the NAS. Check the complete path.
Draw the Intended Path Before Changing Settings
Guest Internet Access
- Guest Device
- Guest SSID
- Guest VLAN
- Gateway Policy
Carry the guest VLAN through the AP uplink and switch to the gateway. Keep staff storage and management access outside the visitor's permitted destinations.
Approved DHCP and DNS services, internet access and the connections required by any chosen portal.
Staff NAS access, administration interfaces and other internal destinations guests do not need.
One designated printer or display service, with a narrow rule and a deliberate discovery policy.
Keep the example addresses private and unambiguous. A planning scheme might use VLAN 10 for Staff, VLAN 20 for Guests and VLAN 30 for Shared Services, each with its own subnet. Those numbers are labels for the example, not universal values to paste into an existing site.
Confirm which device routes those networks and where DHCP and DNS are provided. If a switch performs inter-VLAN routing, a rule only on a separate internet gateway may not control the internal path you intended.
What to Check in a UniFi Deployment
UniFi's guest-network guidance uses Network Isolation for separation from other VLANs, then assigns the WiFi to that network. More selective policies need the appropriate firewall rules for the installed Network application and gateway.
Client Device Isolation has a different scope. Ubiquiti describes the SSID feature as preventing communication between clients on the same AP. Do not take a successful same-AP test as proof that another AP or a wired guest port is covered.
Check switch-level isolation support where it is part of the design. Ubiquiti's switch ACL isolation has model requirements; a mixed switching path needs particular care. Test the deployed equipment instead of treating similarly named controls as interchangeable.
A gateway such as UCG-Fiber is one part of a UniFi design. The AP, switch ports, VLAN mapping and actual firewall policy still determine the result. Gateway throughput is a separate decision from who may reach a shared printer.
What to Check in an Omada Deployment
Omada's Guest Network SSID setting blocks access to private IP subnets in the documented controller workflow. That can be appropriate for internet-only access, but it also affects access to internal printers and displays.
If guests require an internal service, establish the supported policy design for the exact EAP, switch, gateway and controller version. A dedicated VLAN with explicit ACLs can provide more deliberate control than adding a broad exception to a blanket guest restriction. It also needs careful testing.
Check whether a restriction is applied by the EAP, switch or gateway. A rule that looks correct in the controller may have a different traffic scope from the one you assumed. Confirm the required VLANs are carried across the actual ports.
For hosting and availability choices, the OC220 product page provides a local controller option. A controller makes management easier; it does not replace the network access policy.
Why the Printer Appears but Still Will Not Print
Discovery and access are two separate steps. Services such as AirPrint use discovery mechanisms to help a device find a printer. An mDNS relay can make a service visible across selected networks, but the subsequent print connection still needs to be permitted.
Omada's mDNS troubleshooting guidance specifically identifies Guest Network and portal restrictions as reasons a discovered service can remain unusable. Do not assume enabling mDNS overrides those controls. Do not readdress an internal network with public IP space as a casual workaround.
A practical shared-service design places the printer in a controlled service segment and permits only the intended clients and print functions. Record the printer's address, the required protocols and the rule order. If direct printing is unnecessary, a staff-managed print submission process may be simpler.
A Small-Office Policy You Can Actually Test
Consider an office with staff laptops, a NAS, reception printing and visitors attending a training session. Staff need approved NAS folders. Visitors need internet access and one printer. Nobody needs visitors browsing the rest of the LAN.
- Separate the roles. Keep staff, visitor and shared-service devices in their intended segments. Make the port and SSID mapping visible in the site record.
- Keep essential services working. Confirm that a guest receives the right address, resolves names and reaches the internet or required portal.
- Restrict internal access. Apply the supported gateway and local isolation controls for the actual traffic paths, including management destinations.
- Add only the required print route. Permit the approved printer service and any necessary discovery, then test an actual job.
- Verify the boundary. Confirm both the permitted task and the unrelated destinations that must stay unavailable.
The exact rules depend on the installed platform. Preserve an administrator's recovery route, back up the configuration and make planned changes during a suitable window. Avoid changing several isolation features at once when investigating an existing failure.
Do Not Stop at One Successful Internet Test
| Test from a Guest Device | Expected Result |
|---|---|
| Address assignment and normal DNS lookup | The intended guest services work. |
| A normal website and required guest portal | Access works within the chosen policy. |
| Known staff NAS and network management addresses | Access is denied where guests have no approved need. |
| Another guest on the same AP | Peer access follows the isolation policy. |
| Guest on a different AP, and a wired guest device | The same intended restrictions hold across those paths. |
| The designated printer or meeting-room display | The required service works; unrelated access remains restricted. |
| IPv6, if enabled | The intended policy also holds on the IPv6 path. |
Use known test devices and normal connection attempts that you are authorised to make. A missing icon in a discovery list does not prove the destination is blocked. Likewise, a failed ping alone does not establish that file sharing or a web interface is inaccessible.
Choose Hardware That Can Enforce the Policy
The EAP770 illustrates an Omada wireless endpoint; UCG-Fiber illustrates a UniFi gateway. These are examples from different ecosystems, not a matched controller-and-AP pair. Confirm supported features across every device in the chosen design.
If the network is secure but calls still struggle, use the meeting-room WiFi guide to separate airtime, uplink and service problems. Adding isolation does not create extra wireless capacity.
Frequently Asked Questions
Is a separate Guest WiFi name enough to isolate visitors?
No. Confirm the SSID maps to the intended VLAN or subnet and that the actual routing and local peer policies enforce the required restrictions.
What is the difference between VLAN and client isolation?
A VLAN creates a separate network segment. Client isolation restricts communication between peers within its supported scope. Routed access between segments needs its own policy.
Why can a guest see a printer but not print?
Discovery and the print connection are separate. An mDNS relay may advertise the printer while an ACL, firewall, portal or guest restriction blocks the service itself.
Does UniFi Client Device Isolation cover the entire site?
Ubiquiti describes the SSID control as isolating clients on the same AP. Check other APs, wired guests and supported switch-level controls separately.
Does Omada Guest Network allow access to an internal printer?
The documented Guest Network setting blocks access to private IP subnets. Internal printing therefore needs a supported policy design for the exact equipment and software, followed by a real print test.
How should I test that guest WiFi is isolated?
Test essential internet services, known staff and management destinations, peers on the same and different APs, wired guests, any approved printer and IPv6 if enabled. Confirm both allowed and denied outcomes.
Give Guests the Access They Need, Then Verify the Rest
For internet-only access, keep the policy simple and test that internal access is blocked. For printing or casting, design the exception before enabling broad discovery. The successful outcome is a useful visitor network with a boundary that works across the real site.
Bring the current topology, device models, controller version and a list of permitted guest tasks to a network segmentation review. That gives the specialist a concrete policy to implement and verify.
