Most people set up guest Wi-Fi wrong, and their router proves it

Published Aug 2, 2026, 8:15 AM EDT Monica J. White is a journalist with over a decade of experience in covering technology. She built her first PC nearly 20 years ago, and she has since built and tested dozens of PCs. PC hardware is her main beat, and graphics cards and the GPU market at large are her main area of interest, but she has written thousands of articles covering everything related to PCs, laptops, handhelds, and peripherals. From GPUs and CPUs to headsets and software, Monica's always willing to geek out over all things related to computing. Outside of her work with How-To Geek, Monica contributes to TechRadar, PC Gamer, Tom's Guide, Laptop Mag, SlashGear, Whop, and Digital Trends, among others. Her ultimate goal is to make PC gaming and computing approachable and fun to any audience. Monica spends a lot of time elbow-deep in her PC case, as she's always making upgrades, testing something, or plotting out her next build. She's the go-to tech support person in her immediate circle, so she's never out of things to do. Whenever she has spare time, you'll find her gaming until the early hours and hanging out with her dog. Segmenting your network and setting aside a separate SSID for guests is sensible advice that can genuinely make your connection more secure. Unfortunately, it's not that simple. The second Wi-Fi name doesn't always do what you'd expect, and the boundary you thought you created may be nowhere near as solid as you'd hoped. A guest SSID is only a different Wi-Fi entrance The network name doesn't mean all that much Creating a guest network is exactly what it says on the tin: you make a different Wi-Fi name and password to use, and hey, that's helpful. You can share that password without spreading your main Wi-Fi credentials all over the planet. However, an SSID mostly determines how a device joins the wireless network. It doesn't necessarily decide where that device can go afterward. Once someone connects, your router still has to route their traffic. A properly configured guest network should just send that traffic out to the internet, but not let your guests (or rather, their devices) access the private side of your network. If that local-access rule is missing, though, the second SSID may lead straight back to the same devices used by everyone else. There may also be another setting that controls whether guests can communicate with each other. This is usually called client isolation, device isolation, or AP isolation, while access to your main network may be labelled LAN access, intranet access, or network isolation. A whole lot of isolation, eh? But it all leads you to three separate pieces: the guest SSID controls how visitors connect, guest-to-LAN isolation keeps them away from your devices, and client isolation keeps their devices away from one another. Eero Pro 7 Wi-Fi Router At the base of a secure network, you'll always find a secure router. Amazon's Eero Pro 7 gives you Wi-Fi 7 access and 5Gb internet. Local access is the part that can hurt you Reachability comes before compromise Let's cut back on that isolation for a bit to clarify one thing: an unisolated guest doesn't automatically gain access to every file and device in your home. You can stop eyeing them suspiciously for now. Your devices may still have passwords, permissions, and their own security settings standing in the way, but of course, the problem is that they should never be reachable from the guest network in the first place. Once a visitor's device can see your private network, it can start discovering what's connected, loading local management pages, and attempting connections to anything that responds. I know that this whole article makes me sound like I don't trust any of my friends and family members, but that's not what I'm saying here. You can trust your guest while not trusting their phones and other devices. They could be outdated, infected, or running an app that pokes around the local network without them realizing it. It happens more often than you'd think. Proper isolation fixes the problem by removing that whole opportunity entirely. Router names make the right setting hard to figure out Look for access, isolation, and intranet controls Credit: Jason Montoya / How-To Geek If you want to check what the status of your guest network settings is, you can do it pretty easily, but there's a caveat. Any kind of network troubleshooting is always tainted by one major annoyance: router manufacturers don't even try to agree on uniform ways of calling various settings. Your old router may call it Access Intranet, but your new one may call it Allow Local Access. In any case, check for those two options, as well as looking under LAN access, Network Isolation, or Guest Permissions. Once you find something that sounds like it's vaguely right, read into it more. Look for the option that stops guest devices from reaching your main network, not just the one that prevents guest devices from talking to each other. Test the guest network before you do anything else A five-minute check tells you everything you need Credit: Jordan Gloor / How-To Geek When you set everything up, don't assume it works as intended. Test it first. Start with a phone or laptop you trust, connect it to your shiny new guest Wi-Fi, and make sure the internet still works. Then try opening your router's local address in a browser, followed by the local IP address of something on your main network, such as a NAS or a PC. You can usually find those addresses in your router's connected device list before you switch over to the main network. You can also try pinging one of those devices or checking whether it appears under Network in File Explorer, provided you're on Windows. But don't rely on either test alone, as some devices ignore pings, and network discovery can fail at any given time. The result you want to see is that the guest device can connect to the internet but cannot see any other device on the network. Quiz8 Questions · Test Your KnowledgeCreative ways to repurpose an old routerTrivia challengeThink your old router is just e-waste? Think again — see how much you know about giving routers a second life.NetworkingDIYSoftwareHardwareSecurityBeginWhich open-source firmware is most commonly used to unlock advanced features on a repurposed router?AFreeNASBOpenWrtCRaspbianDpfSenseCorrect! OpenWrt is a Linux-based firmware that replaces a router's stock software, unlocking features like advanced traffic shaping, VPN hosting, and package installation. It supports a huge range of router hardware and has a thriving community of developers.Not quite. The answer is OpenWrt, a powerful open-source Linux firmware that transforms compatible routers into highly customizable networking devices. FreeNAS and pfSense are great tools but run on full PCs, while Raspbian is for Raspberry Pi boards.ContinueWhat is a common repurpose for an old router that helps eliminate Wi-Fi dead zones in a large home?ANetwork-attached storage serverBWireless access pointCDNS sinkholeDPacket snifferCorrect! An old router can be configured as a wireless access point, extending your existing network's Wi-Fi coverage to areas your main router can't reach. You simply connect it via Ethernet to your primary router and disable its DHCP server so it doesn't conflict.Not quite. The answer is wireless access point. By connecting an old router to your main router via a cable and tweaking a few settings, you can extend Wi-Fi coverage throughout your home without buying dedicated mesh hardware.ContinueA repurposed router running Pi-hole or similar software can be used to block what type of unwanted content across an entire network?AEncrypted HTTPS trafficBAds and tracking domainsCPeer-to-peer file transfersDVPN tunnelsCorrect! By running a DNS-based ad blocker like Pi-hole on or alongside a repurposed router, you can block ads and tracking domains for every device on your network simultaneously. This means even smart TVs and phones that don't support browser extensions benefit from ad blocking.Not quite. The answer is ads and tracking domains. DNS-level blocking tools like Pi-hole intercept requests to known ad-serving and tracker domains before they even load, protecting your whole network without needing software on each individual device.ContinueWhich of the following can an old router with USB ports be repurposed as, by attaching an external hard drive?AA 4K media transcoderBA basic NAS (network-attached storage) deviceCA cloud gaming serverDA Bluetooth audio receiverCorrect! Many routers with USB ports can share an attached hard drive over the local network, effectively turning the router into a basic NAS device. This lets multiple users on the same network access, store, and stream files from one central location.Not quite. The answer is a basic NAS device. Plugging a USB hard drive into a compatible router lets you create a shared network storage location for backups, media, and files — a surprisingly handy trick that costs almost nothing if you already own the hardware.ContinueWhat networking function allows a repurposed router to connect two physically separate local networks together over the internet securely?ADHCP relayBMAC address filteringCVPN serverDQoS schedulingCorrect! A router flashed with firmware like OpenWrt or DD-WRT can be configured as a VPN server, allowing remote devices or entire remote networks to connect securely as if they were on the same local network. This is great for accessing home resources while traveling.Not quite. The answer is VPN server. Setting up a router as a VPN server creates an encrypted tunnel between the internet and your home network, meaning you can securely access local devices, files, and services from anywhere in the world.ContinueAn old router can be repurposed as a network switch. What is the primary purpose of a network switch?AAssigning IP addresses to devices automaticallyBConnecting multiple wired devices on the same local networkCFiltering internet traffic based on content rulesDBroadcasting a Wi-Fi signal to wireless devicesCorrect! A network switch forwards data packets between wired devices on the same local network, letting you connect more Ethernet-based devices than your main router has ports for. Turning an old router into a switch just requires disabling its DHCP server and connecting it via one of its LAN ports.Not quite. The answer is connecting multiple wired devices on the same local network. A switch expands the number of Ethernet ports available on your network, which is perfect for home offices or entertainment centers with lots of wired devices.ContinueWhich creative repurpose turns a router into a device that detects and logs all gadgets connecting to your home network?APrint serverBNetwork monitorCSmart home hubDMedia centerCorrect! With the right firmware or software, a repurposed router can act as a network monitor, logging connected devices, tracking bandwidth usage, and alerting you to unfamiliar gadgets joining your network. Tools like ntopng or built-in OpenWrt packages make this surprisingly powerful.Not quite. The answer is network monitor. Running monitoring software on an old router gives you a detailed view of everything happening on your home network — from which devices are online to how much data each one is consuming — which is great for security and troubleshooting.ContinueRepurposing a router as a dedicated guest network device offers which key security benefit?AIt doubles the internet speed for all usersBIt isolates visitor devices from your main private networkCIt encrypts all traffic with military-grade AES-512DIt automatically blocks all incoming connections from outside the countryCorrect! Dedicating an old router to a guest network keeps visitor devices completely isolated from your main network, meaning guests can't accidentally — or intentionally — access your personal computers, smart home devices, or shared storage. Network isolation is one of the simplest and most effective home security practices.Not quite. The answer is isolating visitor devices from your main private network. By running a separate router for guests, you create a clean boundary between trusted and untrusted devices, protecting sensitive data and personal gadgets even if a guest's device is compromised.See My ScoreChallenge CompleteYour Score/ 8Thanks for playing!Try Again Turn on both layers of isolation Block the LAN first, then separate the guests Credit: Patrick Campanale / How-To Geek But wait! We're not quite done yet. Head back into the guest network settings and first disable anything labeled Access Intranet, Allow Local Access, LAN Access, or something along those lines. On routers that phrase the setting the other way around, you may need to enable Network Isolation instead. Next, enable Client Isolation, Device Isolation, or AP Isolation if you don't want guest devices talking to each other either. Then re-do what we already discussed: save the changes and test. Guest Wi-Fi only works when rules back it up A guest SSID is still worth having, of course. It's just not some flawless solution to safe internet. A different name and password are only the beginning, and until your router actively blocks local access, you haven't necessarily secured your network all that much. TP-Link Tri-Band BE9700 WiFi 7 Router $190 $250 Save $60 If you want an affordable Wi-Fi 7 router, the TP-Link Archer BE600 is a solid pick.