Why Shared Wi-Fi is an Operational Risk
In many small offices, everyone connects to a single Wi-Fi network: company laptops, employees' personal iPhones, delivery partners asking for the password, smart TVs in the conference room, and wireless CCTV cameras.
If a visitor's phone is infected with a network worm or an unauthorized contractor runs a port scanner like Nmap, every internal system is exposed to direct probing.
Network segmentation divides your physical network into isolated virtual compartments (VLANs), ensuring that a breach in one zone cannot spill over into another.
---
Recommended 4-VLAN Architecture for Indian SMBs
For an office with 15 to 50 employees, we recommend configuring four distinct VLANs:
| VLAN ID | Name | Subnet | Access Level | | :--- | :--- | :--- | :--- | | **VLAN 10** | Management | 192.168.10.0/24 | Network hardware, switch consoles, firewall GUI | | **VLAN 20** | Corporate Staff | 192.168.20.0/24 | Company-managed laptops and workstations | | **VLAN 30** | Guest & BYOD | 192.168.30.0/24 | Visitor phones, personal devices (Internet only) | | **VLAN 40** | IoT & Surveillance | 192.168.40.0/24 | CCTV cameras, biometric attendance, smart TVs |
---
Step 1: Firewall / Router Configuration
- Create the four VLAN interfaces on your router or firewall (e.g., Sophos, FortiGate, pfSense, or Ubiquiti).
- Configure a separate DHCP pool for each VLAN.
- Configure Inter-VLAN Firewall Rules:
- - **VLAN 20 (Corporate) to Internet:** ALLOW.
- - **VLAN 30 (Guest) to Internet:** ALLOW.
- - **VLAN 30 (Guest) to ANY Internal Subnet (10, 20, 40):** **DROP / REJECT.**
- - **VLAN 40 (IoT) to Internet:** ALLOW only required cloud ports (e.g. biometric sync). Block incoming connections.
---
Step 2: Managed Switch Port Tagging
On your smart managed switch: - **Trunk Ports:** The uplink port connecting the router to the switch, and the ports connecting the switch to your Wi-Fi access points, must be configured as **802.1Q Trunk ports** carrying all active VLAN tags (10, 20, 30, 40). - **Access Ports:** Physical wall jacks for staff desktops should be untagged Access ports assigned strictly to VLAN 20. - **CCTV Ports:** Ports connecting security cameras or NVRs should be untagged Access ports assigned to VLAN 40.
---
Step 3: Wireless Access Point SSIDs
Configure your business access points to broadcast multiple wireless SSIDs mapped directly to their respective VLAN tags: - **SSID "Company_Staff":** Mapped to **VLAN 20**. Use WPA2-AES / WPA3-Personal with a complex 20+ character passphrase, or WPA3-Enterprise using 802.1X identity authentication. - **SSID "Company_Guest":** Mapped to **VLAN 30**. Enable **Client Isolation** (sometimes labeled "Guest Isolation" or "Station Separation"). This guarantees that visitors connected to the guest network cannot see or communicate with each other's laptops.
---
Verification Checklist
Before wrapping up your network deployment: 1. Connect a laptop to the Guest Wi-Fi and attempt to ping the router's corporate gateway (`ping 192.168.20.1`). The ping must time out. 2. Attempt to open the web management interface of your switch or firewall from the Guest Wi-Fi. It should be completely unreachable. 3. Verify that staff on the Corporate Wi-Fi can reach the internet and access required local printers or file storage.
By enforcing these boundaries, you transform your office network from a flat, vulnerable pond into a structured, compartmentalized environment.