How to separate guest Wi-Fi from the PMS and card payments
Why one flat network is the most common finding in a hotel IT audit, and what the fix looks like.
In most independent hotels the guest Wi-Fi, the front desk, the tills and the back office all sit on the same flat network, usually because the building was cabled once and everything since has been plugged into whatever port was free. It works until it does not, and it is the single most common finding when we audit a property.
What sharing a network actually risks
- A guest device on the same network as the PMS can see it. Most will never try, but the network cannot tell the difference between a guest browsing and a compromised laptop scanning.
- Card payment terminals sharing a network with guests puts your PCI DSS position in question. The standard expects payment systems to be isolated from untrusted networks, and a shared VLAN is not isolation.
- One infected guest laptop can consume the whole circuit, and the front desk feels it first.
- Troubleshooting becomes guesswork, because nothing is segmented, labelled or monitored separately.
What proper separation looks like
- Separate VLANs for guest, staff, payments, PMS, door locks, CCTV and building services, each with its own address range.
- Firewall rules between them that deny by default, so a device on the guest VLAN cannot reach the PMS at all, rather than being merely discouraged.
- Client isolation on the guest network, so guest devices cannot see each other either.
- A captive portal for guests with terms acceptance, and bandwidth shaping so one device cannot take the circuit.
- Payment terminals on their own segment with outbound rules limited to the acquirer.
- Monitoring per segment, so a problem on the guest network is visible before it reaches the desk.
How the work is phased in a trading hotel
- The building does not have to close. Segmentation is a configuration change on the switching and firewall, followed by moving devices onto the right VLANs.
- The usual approach: audit and document what is connected, design the segments, build them alongside the live network, move systems across one group at a time, then decommission the flat network.
- Payment and PMS devices move last, outside service hours, with the old path left in place until the new one is proven.
Questions worth asking your current provider
- Which VLANs exist on the property today, and what is on each?
- Can a device on the guest Wi-Fi reach the PMS server or a card terminal? Ask them to demonstrate, not assert.
- Where is the network documented, and when was it last updated?
- What happens to segmentation when a new access point or switch is added?
Questions we get asked
Does guest Wi-Fi have to be separate for PCI compliance?
Payment systems must be isolated from untrusted networks, and guest Wi-Fi is untrusted by definition. Segmentation is not the only way to satisfy an assessor, but it is the practical one, and without it the scope of your assessment expands to the whole network.
We have a guest SSID already. Is that not separation?
Not necessarily. A separate SSID can still land on the same VLAN as everything else, which is exactly the common case. The question is what the traffic can reach once it is on the network, not what the network is called.
Will segmenting the network slow the guest Wi-Fi down?
No. Routing between segments happens at line rate on modern switching. Guests usually notice an improvement, because their traffic is no longer competing with back-of-house systems.
Start with the Wi-Fi
A guest Wi-Fi audit is the quickest way to see how we work: we survey the property, test what guests actually experience, and report on what needs doing and what it costs. The findings are yours whether or not you go ahead.
More guides
What happens to a hotel when the PMS goes down
An outage is an operations problem, not an IT problem. What to have ready before it happens.
Read moreHow to change IT provider without disrupting a trading hotel
What a take-on actually involves, what can go wrong, and what to get in writing first.
Read moreWhat a hotel should ask an AI vendor before signing
Twelve questions that separate a useful tool from a feature list with a new label on it.
Read more