How To Create A Secure Vlan For Guest Wi Fi At Home Or Work

Managed and smart switches usually have web-based admin interfaces (or mobile apps) that you can use to configure your VLANs. Other switches with VLAN support will require you to log in with a terminal app and run commands at a command prompt.

Consider whether your guests will need to access things like AirPlay or Chromecast devices while connected to the network—if your guests are connected to a VLAN that’s isolated from these smart devices, they won’t be able to use them. If these devices are specifically for guest use, you’ll need to connect them to the guest VLAN rather than your main VLAN.

Connect the WAN port of your VLAN-capable router to your modem’s LAN port. Connect the main router LAN port to Port 1 of your switch. Connect your Wi-Fi access point(s) to the switch—Port 2 might be your main network, Port 3 (if you have two access points) for your guest network.

If you have one Wi-Fi access point with multiple SSIDs, add its port to all VLANs. Depending on your network setup, you might need to “tag” the VLAN traffic on the switch so it can be properly routed while staying separate. This is most common when using two separate switches. Label Port 1 (the internet connection) as “untagged” and the Wi-Fi port(s) as “tagged. " When devices connect to an access point, they’ll be tagged with their VLAN IDs so the switch knows what to do with the connection. Check your switch’s manual to find out the specific process for tagging and trunking. When tagging, set the PVID for Port 1 and your Wi-Fi access point port(s) to 1. The PVID for all other ports should be set to correspond with its corresponding VLAN ID.

You can use any VLAN ID from 1 to 4093 except for 1 (the management VLAN), 4088 (VOIP), and 4089 (video).

To add a port to your guest VLAN, select a port and tap Untag. All untagged ports will be added to the VLAN. People will be able to connect to these ports and access the internet without seeing traffic on the other (tagged) ports. You must add port 1 to the VLAN in addition to any other ports you wish to add. This is the uplink port—without adding port 1, nobody on the guest VLAN will be able to access the internet.

Type the VLAN ID. VLAN 1 is for management, so don’t enter 1. Choose a number from 2 to 4094 to assign to this VLAN. If entering a range of VLANs, enter the starting and ending ID numbers for the range. Name the VLAN(s). This should be something easy for your guests to identify, such as “Guest. " Click Apply. This saves the VLAN.

Select an interface—GE1 is port 1, GE2 is port 2, etc. You’ll need to configure each separately. Click Edit. For “Interface,” select Port. For “Interface VLAN Mode,” select Trunk for GE1 (your internet connection), and Access for all other ports. Enter the PVID for the selected port (use the VLAN ID) and click Apply. Repeat until you’ve configured all 3 interfaces.

In the left panel, click VLAN Management > VLAN Memberships. In the right panel, select the first VLAN ID and choose Port. Click Search. Select or remove the ports you want to add to this VLAN. Click Apply. Repeat for each VLAN, including VLAN 1.