How to Set Up Guest WiFi in 10 Minutes (eero, Deco, Netgear, Asus, Nest)

To set up guest WiFi, open your router’s app or admin page, find the setting called Guest Network or Guest WiFi, switch it on, give it its own name and password, and make sure guests are blocked from your local network. On almost any router made in the last several years it takes under ten minutes and needs no extra hardware.

Below are the exact steps for eero, TP-Link Deco, Netgear, Asus, Google Nest Wifi and GL.iNet, plus ISP gateways, and the one setting that decides whether the guest network actually protects you.

Guest WiFi isn’t only about guests. That cheap smart plug for the Christmas tree lights may have stopped receiving security updates before it ever left the box, yet it can sit for months on the same network as your laptops, your tax documents, and the NAS with every family photo you own. A guest network is the easiest network segmentation a normal household can do: a separate lane for visitors and for every smart bulb, camera, TV, and doorbell whose security you can’t vouch for.

Why bother: the two-lane driveway

By default, every device on your WiFi can talk to every other device. Your smart kettle can, in networking terms, knock on the door of your laptop. That’s fine until one device gets compromised — a phished houseguest’s phone, a smart camera with a known flaw, that abandoned smart plug — at which point the attacker is standing inside your network, past the firewall, free to probe everything else.

A guest network breaks that. Devices on it get internet access but (when configured correctly — more on that below) can’t see your main network at all. Compromise a bulb on the guest network and you’ve compromised… a bulb. This is the household version of network segmentation, the same measure recommended in CISA’s home network security guidance and the NSA’s best practices for securing your home network.

What belongs on the guest network:

• Visitors’ phones and laptops, obviously
• Smart plugs, bulbs, and switches
• Smart TVs and streaming sticks
• Robot vacuums, smart speakers, WiFi kettles
• Cheap WiFi cameras and doorbells (or better: see our smart home security reviews)
• Kids’ game consoles, if you want an easy way to pause them

What stays on the main network: your computers, phones, printers, and any storage device. Plus anything that genuinely needs to talk to your phone locally, like some Chromecast/AirPlay setups, the one honest trade-off covered at the end. For a device-by-device decision table, see should your smart home devices be on guest WiFi?

Before you start: two rules for any brand

1. Different password, and not a related one. If your main network is Kowalski-Home / sunflower42, don’t make the guest one sunflower42guest. Treat them as strangers.
2. Check the isolation setting. A guest network only protects you if guest devices are blocked from your main LAN. Most brands enable this by default, but the setting has different names — we flag it per brand below.

How to set up guest WiFi on any router: the general steps

Every brand words it differently, but the process is the same everywhere:

1. Open the router’s app or admin page. Most brands now use a phone app. For the web panel, type the address printed on the router’s label into a browser (often 192.168.0.1, 192.168.1.1, or a name such as routerlogin.net) and sign in with the admin password, not the WiFi password.
2. Find the guest setting. Look for Guest Network, Guest WiFi or Guest Access, usually under WiFi, Wireless or Advanced.
3. Turn it on for the 2.4 GHz band at least. Many smart devices only support 2.4 GHz; phones and laptops will happily use 5 GHz too.
4. Name it and set a password. Use WPA2 or WPA2/WPA3 security, never “Open” or “None.”
5. Block access to your local network. This is the setting that matters. It goes by names like “Allow guests to see each other and access my local network” (uncheck it), “Access Intranet” (disable it) or “Network isolation” (enable it).
6. Save, then test. Join the guest network on your phone and try to open a device on your main network, such as the printer’s web page. If it doesn’t load, isolation is working.

eero (including eero Pro 6E)

eero keeps this almost frustratingly simple — there’s exactly one guest network and about three decisions.

1. Open the eero app and tap the menu (bottom right).
2. Tap Guest Access.
3. Toggle Guest Access on.
4. Tap the network name to rename it, and set your own password (or use eero’s generated one).
5. Share it via the app’s share button, or just read the password off the screen.

That’s it. eero isolates guest devices from your main network automatically, with no setting to get wrong — the trade-off being there’s also nothing to customize. No bandwidth limits, no scheduling. For most families that’s a fair deal, and it’s part of why the eero Pro 6E remains our pick for people who never want to see an admin panel.

TP-Link Deco (including Deco XE75)

1. Open the Deco app, tap More (bottom right), then WiFi.
2. Select the Guest Network tab.
3. Toggle on the bands you want guests to use (2.4 GHz for smart devices — many still can’t do 5 GHz; both bands for human guests).
4. Set the network name and a unique password, then Save.
5. Now the important part: go back to More → Advanced and confirm Guest Network Isolation (TP-Link sometimes labels it under “Allow guests to see each other and my main network”) is set so guests cannot access your main network.

Deco also lets you share the guest network as a QR code from the app, which ends the “what’s your WiFi” ritual at the door. Print it and stick it inside a kitchen cabinet. More on the hardware is in our Deco XE75 review.

Netgear (Nighthawk and Orbi)

Netgear splits its world between the app and the web admin panel; the panel gives you more control.

Via the Nighthawk/Orbi app:

1. Open the app and tap the WiFi (or Network) tile.
2. Tap Guest WiFi, toggle it on.
3. Set the name and password, save.

Via the web panel (more options):

1. Browse to routerlogin.net (or orbilogin.net) and sign in with your admin credentials — not your WiFi password.
2. Go to Basic → Guest Network (some firmware: Wireless → Guest Network).
3. Tick Enable Guest Network, set SSID and password, choose WPA2/WPA3 security — never “None.”
4. Crucially, make sure “Allow guests to see each other and access my local network” is UNCHECKED. This one checkbox is the entire difference between segmentation and decoration.
5. Apply, and let the router restart the radios.

Asus (RT and ZenWiFi models)

Asus gives you the most rope here — up to three guest networks per band on many models, which power users use to separate humans from IoT.

1. Browse to router.asus.com and log in to the admin panel.
2. In the left sidebar, click Guest Network (newer firmware: Guest Network Pro).
3. Pick a band and click Enable on the first guest slot. On Guest Network Pro firmware, choose the IoT Network or Guest Portal preset as appropriate — the IoT preset is exactly what smart devices should get.
4. Set the SSID, choose WPA2-Personal or WPA2/WPA3, and set a strong password.
5. Set Access Intranet to Disable. This is Asus’s name for isolation, and it defaults differently across firmware versions — check it explicitly.
6. Optionally set Access Time for actual guests (expires automatically) and leave the IoT network permanent.
7. Apply.

Google Nest Wifi and Google Wifi

Google’s guest network lives in the Google Home app, and Google requires a password for it.

1. Open the Google Home app and tap Wi-Fi (on some app versions: Devices → Network settings).
2. Tap Guest network and turn it on.
3. Enter a guest network name and a password that differs from your main one.
4. Under Shared devices, choose only the devices guests should be able to use, such as a Chromecast in the living room. Leave everything else unshared.
5. Save. To share it later, use the share option in the Wi-Fi section and swipe to the guest network.

The “Shared devices” step is Google’s version of isolation: anything you don’t share stays invisible to guests.

GL.iNet (Flint 2, Flint 3 and others)

GL.iNet describes its guest network as a separate network for devices you want to keep away from your main ones, and it’s set per band.

1. Browse to 192.168.8.1 and sign in to the admin panel.
2. Click Wireless in the left sidebar.
3. In the 2.4 GHz or 5 GHz section, open the Guest Wi-Fi tab and switch on Enable Wi-Fi.
4. Click Modify, set the Wi-Fi Name and a new Wi-Fi Password, then Apply.

The GL.iNet phone app has the same switch under Network → Wireless → Guest Network. Routers like the GL.iNet Flint 2 also support full VLANs if you outgrow a single guest network (more on that below).

ISP gateways (AT&T, Xfinity and others)

If your WiFi comes from the box your internet provider supplied, the guest option is usually in the provider’s app rather than a web page:

• AT&T: in the Smart Home Manager app, tap My Wi-Fi, then the option to create a guest Wi-Fi network. AT&T lists the feature for specific gateway models, so check yours if the option is missing.
• Xfinity: look in the Xfinity app under the WiFi section for the guest network setting.
• Others: check the provider’s app first, then the gateway’s web page (address on the label).

Some ISP gateways offer no guest network at all, or one with no isolation setting you can check. In that case, the cleanest fix is your own router or mesh kit behind the gateway, with its guest network doing the job.

Do you need to buy anything for guest WiFi?

Usually not. Every brand above includes a guest network at no extra cost. New hardware makes sense only in three cases:

• Your ISP gateway has no guest network, or you can’t confirm guests are isolated. Any current router or mesh kit fixes it; our mesh vs. single router guide helps you pick the type.
• You want visitors and smart devices on separate networks. That needs more than one guest network, like Asus’s Guest Network Pro presets above, or a router with VLANs such as the Synology WRX560.
• You’re adding an access point for coverage. A separate access point plugged into your main router only isolates guests if its own guest mode blocks local network access or it supports VLANs. Check that before buying, or its “guest” network may sit right on your main LAN.

If you enjoy this level of control, you’re a candidate for the deeper version of all this. Read on.

Guest network vs. VLANs: when you outgrow the checkbox

A guest network is really a training-wheels version of a VLAN (virtual LAN) — a way of slicing one physical network into isolated logical ones. Consumer routers give you one or two fixed slices. Prosumer gear gives you as many as you want, with firewall rules between them: “cameras can reach the recorder but not the internet,” “kids’ VLAN pauses at 9 pm,” “work laptop can’t see the TV.”

You don’t need VLANs. But if the guest-network setup above felt satisfying rather than tedious, the natural next steps are the GL.iNet Flint 2 or the Ubiquiti Dream Router 7, both of which do proper VLANs at a household price. Our firewalls section compares the field.

The honest trade-offs

Nothing in security is free, so here’s what breaks and how to live with it:

If a device flatly refuses to work with isolation on, that’s useful information about how it’s built — and worth factoring into whether it stays in your house.

The bottom line

Ten minutes, one checkbox that matters (isolation on), and every questionable device in your home moves out of the room where your real data lives. Do it this weekend, put the guest password on a QR code, and never think about it again. And if you’re choosing new hardware anyway, the eero Pro 6E makes this whole article three taps long — it’s the guest-network setup we point non-technical families to, because there’s nothing to get wrong.

Frequently asked questions

Is guest WiFi safe?

Does a guest network slow down my main WiFi?

Can people on my guest WiFi see my devices or my browsing?

What do I need to buy to set up a guest WiFi network at home?

Should smart home devices go on the guest network?