The cheap smart plug we bought for the Christmas tree lights had, we later learned, stopped receiving security updates before we even opened the box. For months it sat on the same network as our laptops, tax documents, and the NAS with every family photo we own. That’s the day we finally set up a guest network — and it took nine minutes.
Guest WiFi isn’t really about guests anymore. It’s the easiest network segmentation a normal household can do: a separate lane for visitors and for every smart bulb, camera, TV, and doorbell whose security you can’t vouch for. Here’s the step-by-step for the four router brands we get asked about most, and the reasoning behind it.
Why bother: the two-lane driveway
By default, every device on your WiFi can talk to every other device. Your smart kettle can, in networking terms, knock on the door of your laptop. That’s fine until one device gets compromised — a phished houseguest’s phone, a smart camera with a known flaw, that abandoned smart plug — at which point the attacker is standing inside your network, past the firewall, free to probe everything else.
A guest network breaks that. Devices on it get internet access but (when configured correctly — more on that below) can’t see your main network at all. Compromise a bulb on the guest network and you’ve compromised… a bulb. This is the household version of network segmentation, the same measure recommended in CISA’s home network security guidance and the NSA’s best practices for securing your home network.
What belongs on the guest network in our house:
- Visitors’ phones and laptops, obviously
- Smart plugs, bulbs, and switches
- Smart TVs and streaming sticks
- Robot vacuums, smart speakers, WiFi kettles
- Cheap WiFi cameras and doorbells (or better: see our smart home security reviews)
- Kids’ game consoles, if you want an easy way to pause them
What stays on the main network: your computers, phones, printers, and any storage device. Plus anything that genuinely needs to talk to your phone locally, like some Chromecast/AirPlay setups — the one honest trade-off, covered at the end.
Before you start: two rules for any brand
- Different password, and not a related one. If your main network is
Kowalski-Home/sunflower42, don’t make the guest onesunflower42guest. Treat them as strangers. - Check the isolation setting. A guest network only protects you if guest devices are blocked from your main LAN. Most brands enable this by default, but the setting has different names — we flag it per brand below.
eero (including eero Pro 6E)
eero keeps this almost frustratingly simple — there’s exactly one guest network and about three decisions.
- Open the eero app and tap the menu (bottom right).
- Tap Guest Access.
- Toggle Guest Access on.
- Tap the network name to rename it, and set your own password (or use eero’s generated one).
- Share it via the app’s share button, or just read the password off the screen.
That’s it. eero isolates guest devices from your main network automatically, with no setting to get wrong — the trade-off being there’s also nothing to customize. No bandwidth limits, no scheduling. For most families that’s a fair deal, and it’s part of why the eero Pro 6E remains our pick for people who never want to see an admin panel.
TP-Link Deco (including Deco XE75)
- Open the Deco app, tap More (bottom right), then WiFi.
- Select the Guest Network tab.
- Toggle on the bands you want guests to use (2.4 GHz for smart devices — many still can’t do 5 GHz; both bands for human guests).
- Set the network name and a unique password, then Save.
- Now the important part: go back to More → Advanced and confirm Guest Network Isolation (TP-Link sometimes labels it under “Allow guests to see each other and my main network”) is set so guests cannot access your main network.
Deco also lets you share the guest network as a QR code from the app, which ends the “what’s your WiFi” ritual at the door. We keep ours printed and stuck inside a kitchen cabinet. Full performance notes are in our Deco XE75 review.
Netgear (Nighthawk and Orbi)
Netgear splits its world between the app and the web admin panel; the panel gives you more control.
Via the Nighthawk/Orbi app:
- Open the app and tap the WiFi (or Network) tile.
- Tap Guest WiFi, toggle it on.
- Set the name and password, save.
Via the web panel (more options):
- Browse to
routerlogin.net(ororbilogin.net) and sign in with your admin credentials — not your WiFi password. - Go to Basic → Guest Network (some firmware: Wireless → Guest Network).
- Tick Enable Guest Network, set SSID and password, choose WPA2/WPA3 security — never “None.”
- Crucially, make sure “Allow guests to see each other and access my local network” is UNCHECKED. This one checkbox is the entire difference between segmentation and decoration.
- Apply, and let the router restart the radios.
Asus (RT and ZenWiFi models)
Asus gives you the most rope here — up to three guest networks per band on many models, which power users use to separate humans from IoT.
- Browse to
router.asus.comand log in to the admin panel. - In the left sidebar, click Guest Network (newer firmware: Guest Network Pro).
- Pick a band and click Enable on the first guest slot. On Guest Network Pro firmware, choose the IoT Network or Guest Portal preset as appropriate — the IoT preset is exactly what smart devices should get.
- Set the SSID, choose WPA2-Personal or WPA2/WPA3, and set a strong password.
- Set Access Intranet to Disable. This is Asus’s name for isolation, and it defaults differently across firmware versions — check it explicitly.
- Optionally set Access Time for actual guests (expires automatically) and leave the IoT network permanent.
- Apply.
If you enjoy this level of control, you’re a candidate for the deeper version of all this — read on.
Guest network vs. VLANs: when you outgrow the checkbox
A guest network is really a training-wheels version of a VLAN (virtual LAN) — a way of slicing one physical network into isolated logical ones. Consumer routers give you one or two fixed slices. Prosumer gear gives you as many as you want, with firewall rules between them: “cameras can reach the recorder but not the internet,” “kids’ VLAN pauses at 9 pm,” “work laptop can’t see the TV.”
You don’t need VLANs. But if the guest-network setup above felt satisfying rather than tedious, the natural next steps are the GL.iNet Flint 2 or the Ubiquiti Dream Router 7, both of which do proper VLANs at a household price. Our firewalls section compares the field.
The honest trade-offs
Nothing in security is free, so here’s what breaks and how we live with it:
| Trade-off | Reality in our house |
|---|---|
| Casting/AirPlay across networks fails | Phones can’t cast to a TV on the guest network. Either keep the streaming device on the main network, or use apps’ built-in casting via the cloud (most now work this way) |
| Smart home apps during setup | Many devices require your phone on the same network during initial pairing only. Join the guest network on your phone for five minutes, pair, switch back |
| Printers on the main network | Guests can’t print. In practice: email it to us and we’ll print it |
| Two passwords to remember | The QR-code-in-the-cabinet trick solves it permanently |
If a device flatly refuses to work with isolation on, that’s useful information about how it’s built — and worth factoring into whether it stays in your house.
The bottom line
Ten minutes, one checkbox that matters (isolation on), and every questionable device in your home moves out of the room where your real data lives. Do it this weekend, put the guest password on a QR code, and never think about it again. And if you’re choosing new hardware anyway, the eero Pro 6E makes this whole article three taps long — it’s the guest-network setup we recommend to relatives precisely because there’s nothing to get wrong.