Guest Network

What is a guest network?

A guest network is a separate network segment that gives temporary or external users, such as visitors, contractors and suppliers, only limited access (usually internet only), with no route at all to the internal corporate or production network. It is physically or logically separated, for example through its own VLAN, its own wireless network name (SSID) and a firewall that blocks all inbound traffic. In industrial environments, a guest network prevents an unknown laptop or phone from joining the network right next to a PLC or HMI. It is therefore a simple but essential application of network segmentation.

🧠 Why does a factory need a guest network?

Every day a production site hosts people who are not employees: service engineers, commissioning staff, auditors, temporary workers and visitors. Nearly all of them want internet access: to look up manuals, reach their own support team through a VPN or download software. Without a guest network, two bad workarounds appear:

• Connecting to the corporate network - an infected laptop then sits inside the perimeter and can spread malware or ransomware. Such an unknown device is a classic rogue device.
• Private 4G/5G routers or hotspots - engineers set up their own mobile router, sometimes even inside a control cabinet. That creates an uncontrolled internet connection that bypasses every firewall.

A good guest network removes the pressure behind those workarounds: anyone who needs the internet gets it quickly and easily, but through a segment that knows nothing about the OT and IT systems. It reduces the risk of malware, data leaks and unwanted access, and strengthens the cybersecurity of the whole site without getting in visitors’ way.

🧱 What are the characteristics of a good guest network?

🔧 How is a guest network technically separated?

There are three common levels of separation, from weak to strong:

1. Only a separate SSID on the same access points, mapped to its own VLAN. This is the baseline and is only sufficient when the firewall between that VLAN and everything else is strictly configured.
2. Guest VLAN tunnelled to a guest firewall - many Wi-Fi platforms tunnel guest traffic from each access point straight to a firewall or controller at the network edge. Guest traffic then never touches internal switches or routers.
3. Physically separate infrastructure - dedicated access points, dedicated switch ports and a dedicated internet connection, for example a separate fibre or 5G link. This is common on sites with critical processes.

A guest network does not belong in a DMZ, by the way. A DMZ is meant for servers that must be reachable from outside, such as a web server or a jump server; guest devices are unknown clients that should only ever connect outward.

With Wi-Fi, encryption matters too. An open guest network without a password sends traffic unencrypted over the air. Opportunistic Wireless Encryption (OWE), described in RFC 8110 (March 2017) and certified by the Wi-Fi Alliance since 2018 as Wi-Fi CERTIFIED Enhanced Open, encrypts each connection without a password. OWE does not authenticate anyone, however: it protects against eavesdropping, not against a fake access point (evil twin). Devices that do need to be authenticated, such as employees’ managed laptops, therefore belong on a separate corporate network with WPA3-Enterprise, 802.1X and RADIUS.

A captive portal first sends a new user to a sign-in page. Traditionally, a device discovers such a portal because the network intercepts and redirects its first web request. Modern networks advertise the portal through the options in RFC 8910 (September 2020: DHCPv4 option 114, DHCPv6 option 103 and an IPv6 Router Advertisement option), so operating systems can show the sign-in screen directly, without redirection tricks.

🔐 How does a guest network fit IEC 62443 and zones and conduits?

In the zones and conduits model, the guest network is a zone of its own with the lowest trust level, comparable to the internet itself. The only permitted conduit leads outward, to the internet. There should be no conduit from the guest network to corporate or OT zones, not even “only via a jump server”.

The relevant requirements from IEC 62443-3-3 are:

NIST SP 800-82 (Rev. 3, September 2023) likewise recommends separating OT networks from all other networks. If guest traffic does run over the corporate infrastructure, make sure there is another firewall between the corporate network and OT in addition to the guest firewall; a fully separate internet breakout is better still.

🏭 How should you handle suppliers and service engineers?

Suppliers are the hardest group, because they often do need to reach the installation. The guest network is not meant for that. Common practice:

• Internet for their own work - an engineer uses the guest network to look up manuals, reach their own support team through a VPN or download firmware updates.
• Files into OT through a checkpoint - downloaded firmware does not go straight from the guest network to a PLC. Verify the hash or digital signature, scan the file and bring it in through a controlled route or a USB policy.
• Access to the installation through a separate route - anyone who needs to work on the control system uses secured remote access or remote maintenance with MFA to a jump server in the IDMZ, or an engineering station managed by the asset owner.
• Contractual agreements - state in the contract that suppliers do not install their own modems or hotspots. This is part of supplier security and of IEC 62443-2-4 for service providers.

🛠️ How do you set up a guest network step by step?

1. Define the user groups - visitors, suppliers, temporary workers and employees’ personal phones (BYOD) often each get their own profile or network.
2. Choose the level of separation - a dedicated internet breakout on a site with critical processes; elsewhere at least a tunnelled guest VLAN.
3. Configure the firewall - deny everything by default, allow only outbound internet traffic (for example HTTP/HTTPS, DNS and VPN ports) and block all private address ranges.
4. Enable client isolation on access points and switches.
5. Set up sign-in - vouchers or sponsor approval, valid for example for 8 to 24 hours.
6. Limit bandwidth per user so guests cannot crowd out business connections.
7. Keep logs and retain them no longer than necessary, because MAC and IP addresses linked to a person are personal data under the GDPR (in Dutch: AVG).
8. Test periodically - try to reach internal addresses from a guest device; every successful connection is a finding.

For organisations covered by the Dutch Cybersecurity Act (in force since 15 August 2026), a separated guest network falls under the duty of care to take appropriate network security measures. It is also a simple, visible part of Zero Trust: no device is trusted merely because it is on site.

❓ Frequently asked questions

Is a separate password enough for a secure guest network?

A separate password alone is not enough for a secure guest network. The separation lies in the VLAN and above all in the firewall that blocks all traffic to internal networks. A password that stays the same for years and is written on a whiteboard offers little protection anyway.

May a supplier reach a PLC through the guest network?

No, a supplier should never be able to reach a PLC or any other OT system through the guest network. The guest network provides internet access only. Work on the control system goes through a separate, secured remote access route with MFA, logging and approval by the asset owner.

Is an open guest network without a password insecure?

An open guest network without a password sends traffic unencrypted over the air, unless it uses OWE (Wi-Fi Enhanced Open). For the corporate networks, an open guest network is no more dangerous as long as the firewall separates strictly. A captive portal or voucher does help you keep track of who uses the network.

What is client isolation in a guest network?

Client isolation is a setting that prevents devices on the same guest network from reaching each other. An infected visitor’s laptop therefore cannot attack other guests. Each guest’s traffic goes only to the gateway and the internet.

Does the guest network need its own internet connection?

A dedicated internet connection is not mandatory, but it is the strongest form of separation for a guest network. Guest traffic then touches no internal router or firewall at all. On sites with critical processes, such as water treatment or chemicals, this is therefore common practice.

How long may I keep data about guest users?

Data about guest users, such as MAC addresses, IP addresses and sign-in names, is personal data under the GDPR. You keep it only as long as necessary for security and incident investigation, and you mention this in your privacy notice. A fixed, short retention period makes that demonstrable.

📌 In summary

A guest network is a separate network segment that gives visitors and suppliers internet access only, with no route at all to corporate or OT systems. Its own VLAN or internet breakout, a firewall that denies everything by default, client isolation and temporary sign-in make it secure. Work on the installation itself never runs through the guest network, but through a separate, secured remote access route.