Best way to set up guest Wi-Fi in a doctor's office? (Streaming Security EP8 question)

Networking & Firewalls
1

On Streaming Security EP8, Tom was talking about a hospital network and mentioned that you don’t want guest users exiting out from the main network, and one of the solutions was to have guests exit out of a VPN instead.

My curiosity came up because I was referred to a doctor’s office that wanted to upgrade their network from a standard Spectrum router + TP-Link switch + UniFi AP setup (installed by the original contractor who did the remodel of the office in the building). For a small office (depending on the business) with just a few people, I’ve been comfortable helping set up a Unifi router and ISP modem. It wasn’t until I was in this scenario, where the owner had patients connecting to the Spectrum Wi-Fi on the exact same LAN & SSID as his PCs, printers, and VoIP phones, that I realized he was trying to provide Wi-Fi to patients too.

Even though I didn’t end up taking on that setup, it got me researching how to truly do guest Wi-Fi safely in that kind of environment, and I never got a straight answer online. Originally, the only solution I could come up with was getting a separate device with a SIM card to act as a 2nd WAN just for guests to exit out of.

When I heard Tom mention sending them out through a VPN on the stream, it got me wondering:

If you send guests out a VPN, what kind of VPN service online actually provides that for guest networks? Does Mullvad or Proton VPN fit this scenario?
Or is having a segmented guest network with region blocking/filtering leaving out the regular WAN enough?
Just asking for my own knowledge in case this scenario comes up again. I’m curious to learn how you guys handle it.

2

VPN provider doest matter at all. They are not the one that control the network and what goes where. Its you. You need to have hardware/software solution in a doctors office that gives you this capability. That means you need something like a Netgate or Unifi appliance. Lets say you have a Netgate appliance that runs pfSense and you have Unifi U6 as an access point. You configure a VPN tunnel in your pfSense appliance, you create a new guest VLAN, and you configure that VLAN to use newly create VPN as a gateway. Then you create two SSID`s on your access point. One for the doctors office with no VLAN assigned, and the second SSID called Guest network which will be tied to your VLAN. And thats pretty much it. Whoever connects to a Guest network will go through VPN, and they wont be able to reach local network. And speaking of local networks, make sure they have L2 isolation enabled as well. Just keep in mind that this is very simplified explanation. It all depends what hardware you have at doctors office and whether or not it is capable of achieving all this.

1 Like
3

It should be pretty straight forward if your AP is capable of multiple SSID’s which can then be mapped to your VLAN capable switch. Then in router you need rules to separate the Workers VLAN from the Guest VLAN. Don’t really see any need for a VPN, however you might want something like cloudflare DNS on the guest network that also blocks some porn sites etc. In this set-up you could still have any vlan exiting from the WAN or VPN gateway.