Illustrative scenario. A small hotel in Gallura provides room Wi-Fi, runs a reception management system and has connected TVs. A guest notices an office printer among the available devices. Renaming the wireless network does not establish which connections are allowed: the hotel needs an access plan.
Map who needs to reach what
Before configuration, prepare three inventories: guest devices; staff computers, printers and tools; and TVs or other connected equipment. Network administration also needs restricted access. In this example, guests need internet access, reception needs its printer and management software, and a TV should not reach office documents.
Turn that map into a permissions table listing source, destination, purpose and owner. Describe each exception separately. Allowing all communication between two networks just to make one printer work makes it difficult to understand what has actually been authorised.
VLANs, firewall rules and device isolation
VLANs organise separate logical networks; firewall rules control communication between them. Traffic between guests on the same network also needs attention. The UniFi guest Wi-Fi guide distinguishes network isolation, client isolation at the access point and switch-level controls. Check what the installed equipment supports, without assuming a single setting covers every traffic path.
A welcome portal manages how a guest gains access. The UniFi captive portal documentation describes several authentication methods. A screen with a logo and password does not, on its own, prove that the full configuration follows the hotel's access plan.
The particular case of in-room TVs
“I want to cast from my phone to the TV” is a specific requirement. In our scenario, a guest in room 12 should reach only the assigned TV, not the one next door. Before enabling discovery services between networks, check the intended casting system and its compatibility with isolation. Test the solution with different phones and after a guest changeover.
Four acceptance checks
- Using a test device on guest Wi-Fi, verify internet access and blocked access to the office printer, file storage and router administration.
- Repeat the checks with two guest devices on the same access point, then on different access points. Include any wired sockets in guest rooms.
- From reception, verify authorised management software functions and printing without using real guest data for the test.
- If casting is included, test it in the assigned room and verify that another room cannot control that TV.
The handover should include a table of results, exceptions and equipment involved. Measure Wi-Fi coverage separately: an isolated network can still have areas with insufficient signal.
Our hotel networking and technology service starts with the property's required functions. A floor plan and device inventory help create access arrangements that are understandable for management and straightforward for guests.
