Handing a visitor your main Wi-Fi password gives them your printer, the shared folder on your desktop, the smart TV and possibly the router’s admin page. A guest network exists precisely so you never have to make that trade. The setup takes about fifteen minutes and most of it is on one screen.
Start at the admin page, not the Wi-Fi settings
Type the gateway address into a browser. It is 192.168.0.1 on most TP-Link and Netgear units, 192.168.1.1 on Asus and D-Link, 192.168.8.1 on Huawei ONTs handed out by fibre ISPs, and 192.168.100.1 on some Motorola cable modems. If none of those answer, run ipconfig in Command Prompt and read the “Default Gateway” line, or on a Mac look under System Settings > Network > Wi-Fi > Details > TCP/IP.
Three things on that page matter more than anything else you will do tonight.
- The admin password. Old TP-Link Archer C6 units ship with admin/admin and plenty of people never change it. Anyone on your Wi-Fi who guesses it can turn off your firewall, change your DNS, or lock you out of your own router.
- Remote management. On TP-Link it hides at Advanced > System > Administration; on Asus at Administration > System > Enable Web Access from WAN. Set it to off. You do not need to administer the router from a bus.
- Firmware. TP-Link puts it at Advanced > System > Firmware Update, Asus at Administration > Firmware Upgrade, Netgear at Advanced > Administration. A router three years behind on patches has published vulnerabilities that script kiddies run automatically.
A guest network that cannot see the house
In the router’s wireless section there is a guest SSID toggle. Turning it on is the easy half; the isolation switch is the half people miss.
Netgear words it as “Allow guests to see each other and access my local network” and it defaults to on. TP-Link calls it “Allow Guest to Access Local Network”, and on Deco units the same option sits under Wi-Fi Settings > Guest Network. Asus labels it “Access Intranet” inside the Guest Network tab. All three must be off. With them off, a guest phone can reach the internet and nothing else: no SMB shares, no Chromecast, no printer, no admin page.
For security, choose WPA3-Personal if every device in the house supports it, because it replaces the pre-shared-key handshake with an exchange that cannot be cracked offline from a captured packet. The Wi-Fi Alliance explains the difference. If somebody still owns a 2016 smart plug, use WPA2/WPA3 mixed mode: those devices fall back to WPA2 and the rest of the network still gets the stronger option.
Set the guest password to something you can read out loud but nobody can guess, sixteen characters or more, and make it different from the main network’s. That single decision is what protects you later, when the password has been shared onward three times.
Three services to switch off tonight
WPS. The push-button version is convenient; the PIN version is not safe. The PIN is eight digits with the last one a checksum, which cuts the search space to about eleven thousand combinations, and tools exist that walk it in minutes from outside your house. Turn WPS off completely rather than leaving it “enabled but unused”. The toggle is under Wireless > WPS on Asus and Advanced > Wireless > WPS on TP-Link.
UPnP. Universal Plug and Play lets any program on your network ask the router to open an inbound port, with no authentication. It is genuinely useful for games consoles and torrent clients, and it is also how a single infected laptop can punch a hole through your firewall. If nobody in the house games online, disable it at Advanced > NAT Forwarding > UPnP.
Cloud accounts you forgot. TP-Link ID, Asus Router account, Netgear Orbi app login. Each is a remote path into the router. If you set one up years ago and no longer use the app, delete the binding rather than leaving a stale credential in the cloud.
Read the client list while people are over
Once the guest SSID is live, the client list becomes an instrument. TP-Link shows it under Network Map > Clients, Asus under Network Map > View List, Netgear under Attached Devices: hostnames such as “Redmi-Note-13”, a MAC address, a signal reading.
Do not panic when the list looks longer than the number of people in the room. Modern phones rotate their MAC address per network, so the same handset can appear as two entries, and a laptop asleep in a bag still holds a lease. What deserves attention is a hostname you cannot place that is transferring data while nobody is visiting.
Guests who stream will eat the connection. Set a bandwidth limit on the guest SSID, or enable QoS and rank the guest network below your own devices.
The ten-minute pack-down
When the visit ends, switch the guest SSID off rather than leaving it broadcasting. A network that exists only when needed has no password to leak between visits, and the toggle takes seconds.
If guests are staying a week, leave it on, then rotate the password at the end and check the client list once more. Reboot from the admin page before you do, which applies the firmware properly.
For choosing channels and placing the unit so the guest signal reaches the balcony, our router placement notes cover the physical side, and if you would rather run visitors on a separate box entirely, setting up a dedicated guest network on an old router is a reasonable next step.