Problem
Guest Wi-Fi is not isolated from the workstation used for channel administration.
Solution
Root Cause / Diagnostic:
Failing to isolate guest wireless networks allows visitors, temporary set guests, and compromised mobile devices to communicate directly with production workstations. An infected guest phone on an unsegmented Wi-Fi network can perform automated subnet scanning and broadcast LLMNR/NBT-NS poisoning attacks to capture password hashes. Allowing open broadcast domains between guest visitors and production infrastructure fundamentally compromises channel workstation safety.
Actionable Fix:
1. Enable Wireless Client Isolation and Guest Network isolation on the studio access point controller, placing guest traffic on a dedicated tagged VLAN (e.g., VLAN 99).
2. Apply firewall rules on the gateway router blocking Guest VLAN traffic from accessing RFC1918 private subnets (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`), allowing outbound Internet traffic only on ports 80/443/53.
3. Validate isolation by connecting a mobile device to Guest Wi-Fi and attempting to access the local NAS web interface or ping production workstation IPs, ensuring all connections time out.
Pro Tip:
Implement time-decaying guest Wi-Fi credentials with automated 8-hour session expiry and dynamic captive portal separation to prevent permanent background connection from past visitors.
Failing to isolate guest wireless networks allows visitors, temporary set guests, and compromised mobile devices to communicate directly with production workstations. An infected guest phone on an unsegmented Wi-Fi network can perform automated subnet scanning and broadcast LLMNR/NBT-NS poisoning attacks to capture password hashes. Allowing open broadcast domains between guest visitors and production infrastructure fundamentally compromises channel workstation safety.
Actionable Fix:
1. Enable Wireless Client Isolation and Guest Network isolation on the studio access point controller, placing guest traffic on a dedicated tagged VLAN (e.g., VLAN 99).
2. Apply firewall rules on the gateway router blocking Guest VLAN traffic from accessing RFC1918 private subnets (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`), allowing outbound Internet traffic only on ports 80/443/53.
3. Validate isolation by connecting a mobile device to Guest Wi-Fi and attempting to access the local NAS web interface or ping production workstation IPs, ensuring all connections time out.
Pro Tip:
Implement time-decaying guest Wi-Fi credentials with automated 8-hour session expiry and dynamic captive portal separation to prevent permanent background connection from past visitors.