Guest Wi-Fi security: how to protect the hotel network
A single Wi-Fi network serving guests, the front desk, the PMS and the security cameras at the same time is a recurring, and serious, infrastructure weakness in hotels. Here is how to segment the network properly without making it harder for guests to connect.
A frequent mistake: one network for everything
In many hotels, especially mid-sized ones that have grown organically over the years, the Wi-Fi network was built up bit by bit: first for guests, then the front desk "borrowed" the same network for the PMS computer, then the security cameras were installed on the nearest available Wi-Fi. The result is a single flat network where a guest's laptop and the terminal that processes booking payments are, as far as the network is concerned, in the same place.
This is not a minor technical detail. It is the difference between a malicious guest (or a guest device already infected with malware) only being able to browse the internet, and that same device being able to see and try to reach the front desk printer, the PMS server or a security camera.
The minimum model: four separate networks
- Guest network: internet access, with no visibility of any other hotel equipment, ideally with a captive portal and a unique code per stay.
- Administrative network: the PMS, front desk computers and management systems, completely isolated from the guest network.
- Payment network: POS terminals and systems that process cards, also kept separate from the administrative network, which reduces PCI DSS scope.
- Infrastructure and IoT network: security cameras, electronic door locks (digital or keyless entry), building automation and other connected devices, isolated from both the guest and the administrative networks.
Technically, this is done with VLANs (virtual local area networks) configured on the switch and the Wi-Fi controller, with explicit firewall rules that block all traffic between these four networks except what is strictly necessary (for example, a central monitoring system that needs to read data from the cameras).
Why cameras and locks deserve their own network
IoT devices, such as security cameras, electronic door locks and automation sensors, tend to have two recurring problems: firmware that is rarely updated, and a factory default password that was never changed during installation. That makes them some of the easiest targets to compromise on any network, which is why they should never share a network with the administrative area or, worse, with guests.
A dedicated VLAN for these devices, with internet access restricted to the minimum needed (or none, when the device only needs to be reached locally), greatly reduces their attack surface.
Captive portal: security without spoiling the guest experience
Segmenting the network does not mean making guest Wi-Fi complicated to use. A well-configured captive portal, with a unique code per stay generated automatically by the PMS (and not an easy-to-guess combination such as room number and surname), meets two goals at once: it keeps connecting simple for whoever is staying, and it shows which stay used the network, which helps when investigating misuse. Combined with client isolation on the Wi-Fi controller, which stops guest devices from talking to each other directly, it makes it harder for a compromised device to attack the laptop in the room next door.
Open networks with no password at all still turn up in smaller hotels. Today most browsing is already encrypted (HTTPS), so the main problem is not so much someone reading guest traffic as everything else: anyone within range of the signal can join the network, it becomes easier to set up a fake network with the same name to trick guests (a so-called evil twin), there is no way of knowing which stay used the network and, without client isolation, devices are exposed to one another.
How to tell whether your network is already exposed
A simple test, though no substitute for a full audit, is to connect a laptop to the guest network and try to reach the IP address of a known administrative device, such as the front desk printer. If there is any network response at all (even without being able to use the device), the segmentation is not working as it should. A formal technical audit reviews the VLAN configuration and the firewall rules between them, and tests that isolation systematically, including the physical Wi-Fi access points and their configuration.
Marco Civil da Internet: keeping connection logs
Beyond segmentation, offering Wi-Fi to guests raises a legal question of its own in Brazil, separate from the LGPD (Brazil's data protection law). The Marco Civil da Internet, Brazil's internet civil rights framework (Law 12,965/2014, art. 13), requires whoever provides internet connection, as the administrator of an autonomous system, to keep connection records (IP address, and the date and time each session started and ended) for one year, confidentially, and to hand them over only under a court order. Whether and how this obligation reaches a hotel's Wi-Fi depends on how the service is provided and by whom, and the question is not settled. The prudent position is to keep these records for one year, make clear in the contract who keeps them when the network is run by a managed Wi-Fi provider and confirm the model with the hotel's lawyers. We cover this alongside other Brazilian rules in our guide to hotel IT compliance in Brazil.
In practice, the captive portal or the Wi-Fi controller needs to produce this log in an auditable way, linked to the booking or the authenticated device, and not just hand out internet access with no record behind it.
Next steps
Segmenting the network of a hotel that is already operating, without interrupting the PMS or guest access during the change, takes careful technical planning. As part of our ongoing IT management work, our team carries out this assessment, plans the segmentation in stages and coordinates the network supplier that implements it, so the change happens without stopping the operation. Talk to our team.
Network infrastructure for hotels
Network assessment, design of the VLAN segmentation and of the captive portal for guest Wi-Fi, with supervision of the supplier that implements it.
View service- Network segmentation assessment
- VLAN and firewall rule design
- Captive portal requirements for guests
- Isolation of cameras and IoT
Related reading
Is it safe for a hotel to have a single Wi-Fi network for guests and staff?
No. A single Wi-Fi network without segmentation lets a compromised guest device (or a malicious guest) try to reach printers, the PMS, cameras and other administrative equipment that should be isolated. The recommended minimum is at least four separate networks: guests, administrative, payments and infrastructure equipment, each on its own VLAN.
Is a guest Wi-Fi network without a password a security risk?
An open network with no authentication at all makes attacks between different guests' devices on the same network easier, and makes it harder to trace which device did what in case of misuse. The safest model that does not spoil the experience is a captive portal with a unique code per stay, generated by the PMS (and not a predictable combination such as room number and surname), combined with client isolation on the Wi-Fi controller, which stops guest devices from talking to each other directly.
Should the PMS be on the same Wi-Fi network that guests use?
No, never. The PMS, payment terminals and any administrative system should sit on a VLAN completely isolated from the guest network, with no possible network route between the two, even if they are physically connected to the same Wi-Fi access points. That is what stops an attack from a guest device from reaching booking or payment data.
Should security cameras and electronic locks be on the same network as guests?
No. Cameras, electronic locks, building automation systems and the hotel's other IoT devices should sit on their own VLAN, separate from both the guest and the administrative networks. These devices often have outdated firmware and default passwords that were never changed, which makes them an easy target if they can be reached from the public guest network.
How can a hotel tell whether its Wi-Fi network is properly segmented?
The most direct test is to try, from a device connected to the guest network, to reach the IP address of a known administrative device, such as a front desk printer or the PMS server. If there is any response or access, the segmentation is not working. A technical network audit confirms this fully, including the configuration of the VLANs and the firewall rules between them.
Does a hotel in Brazil need to keep guest Wi-Fi connection logs?
As a precaution, yes. Brazil's Marco Civil da Internet (Law 12,965/2014, art. 13) requires the autonomous system administrator that provides connection to keep connection records for one year, confidentially, and to hand them over only under a court order. Whether and how this applies to a hotel's Wi-Fi depends on how the service is provided and by whom, and the question is not settled. The prudent recommendation is therefore to keep these records for one year in a secure environment, set out in the contract who keeps them when the network is run by a managed Wi-Fi provider and confirm the model with the hotel's lawyers.
Segment your hotel's network before an incident forces you to
Talk to our team and book an assessment of your hotel's Wi-Fi network and infrastructure.