Ubiquiti has two guest options. The simple one is a separate WiFi network on its own VLAN with client isolation: under Settings, WiFi, choose the network and enable Client Device Isolation, which blocks communication between clients on the same AP even on the same VLAN, ideal for guests and IoT. Ubiquiti's Best Practices: Guest WiFi article says a guest network should be a separate network so guests cannot reach your devices and should use firewall rules to keep them off the local network.
The checks in more detail
The richer option is the Hotspot Portal: convert a WiFi instance to a Hotspot Portal under Settings, WiFi, select the network and enable Hotspot Portal, then use the Hotspot Manager on the left sidebar and its Landing Page tab to customize the page, with options such as passwords, vouchers or terms acceptance. If guests cannot connect, check the guest SSID is enabled on the AP group, that its VLAN is tagged to the AP's switch port, that DHCP serves that VLAN, and that the portal is not blocking the guest before authorization.
If guests connect but have no internet, check the firewall zone rules and the gateway. If guests reach your devices, review the isolation and firewall settings. Limit guest bandwidth if needed and set a time limit or an expiry for vouchers. Give guests a short, readable name and password, and a landing page with your terms if you use the portal.
Set a time limit for guest sessions so devices are removed automatically, and check the guest network after each firmware update, since network and firewall behavior can change between releases. Test as a guest, on a phone that is not part of your network, and confirm you cannot reach the printer or the gateway's admin page. If you use vouchers, print or send them only to the people who need them, and set an expiry, so a shared voucher does not become a permanent password.
Differential
Likely causes of “Ubiquiti UniFi access points guest network cannot reach devices, cast or print”, and how to tell them apart
- 1
The SSID not on the AP group
What separates it Guests cannot see the guest network because its SSID is not enabled on the AP group
How to confirm Enable the SSID on the AP group that covers the area where guests will be
- 2
A VLAN not tagged
What separates it Guests get no address because the VLAN is not tagged on the access point's port
How to confirm Tag the VLAN on the switch port that the access point is connected to
- 3
The portal blocks before authorization
What separates it Guests are stuck because the portal or the firewall blocks them before they are authorized
How to confirm Check the portal settings and the firewall rules, so guests can reach the login page
- 4
No isolation
What separates it Guests can see local devices because there is no isolation on the guest network
How to confirm Enable client isolation and add firewall rules to keep guests off the local devices
- 5
A device that needs local access
What separates it Casting or printing fails because the device needs local access, which the guest network denies
How to confirm Use the main network for that device, since the guest network is kept apart on purpose
Before you touch a setting
Record this first — changing settings destroys the evidence
- The name of the guest SSID and the VLAN that it uses
- Whether isolation and the portal are on
- What guests can and cannot reach
- The firewall zone rules that apply to the guest network
Try in this order
0 of 7 completedCreate the SSID
ReversibleCreate the SSID, by going to Settings and then WiFi, and choosing to add a new network.
Put it on its own network
ReversiblePut it on its own network, with its own VLAN, so that guests are kept apart from your devices.
Enable client isolation
ReversibleEnable Client Device Isolation, so that guests cannot talk to each other on the wifi.
Enable the portal
ReversibleEnable the portal, if you want guests to see a login or terms page before they join.
Customize the landing page
ReversibleCustomize the landing page in Hotspot Manager, if you use the portal for your guests.
Test as a guest
ReversibleTest as a guest, by joining the network on a phone that is not part of your main network.
Review the firewall
ReversibleReview the firewall, so that guests stay off the local devices, and can only reach the internet.
Model-specific
What is true of this model and not of its siblings
- Bands
- Guest SSIDs can be broadcast on all bands the AP supports.
- Portals
- The portal is a Network application feature, not an AP feature.
- Other models this page answers
- These steps also fit the UniFi U6 Pro access point.
Stop boundary
When this stops being a self-service repair
- !If guests get no address, check VLAN tagging and DHCP
- !If the portal will not load, check the gateway and DNS
- !If guests reach local devices, review firewall rules
Evidence ledger
Sources behind this answer
Guest WiFi design.
Client isolation.
Hotspot portal.
SSID options.
The company and its products.
Exact questions
Common questions
How do I isolate guests?+
Enable Client Device Isolation, and use a separate network for guests.
What is a Hotspot Portal?+
A Hotspot Portal is a captive portal, which is a login page that guests see on joining.
Where do I customize it?+
You customize it in Hotspot Manager, on the Landing Page tab.
Can I use vouchers?+
Yes, you can use vouchers with the hotspot, to give guests timed access.
Should the guest network be a VLAN?+
Ubiquiti recommends using a separate network, and a separate VLAN, for the guest network.
Why do guests get no address?+
Guests may get no address because the VLAN is not tagged on the access point's port.
Can guests print?+
Not from an isolated guest network, since printers usually sit on the main network.
Should I turn it off?+
Yes, turn it off when it is not needed, so that nobody can use it without you knowing.