Why Your Guest WiFi Should Never Touch Your POS System
We walk into a restaurant, retail shop, or small office and ask one question: "Is your guest WiFi on the same network as your POS?" The answer is almost always yes. That's a problem — and fixing it is simpler than you think.
This Is a PCI-DSS Violation
PCI-DSS (Payment Card Industry Data Security Standard) — the compliance framework required to accept card payments — explicitly requires that cardholder data environments be isolated from any network accessible by guests or untrusted devices. Running your POS on the same network as your guest WiFi puts you out of compliance, which can result in fines and revoked card processing privileges after a breach.
What Actually Happens When They're on the Same Network
When a customer connects to your guest WiFi, they're on the same local network as your POS terminal, your server, and potentially your security cameras and backoffice computers. Any device on that network can attempt to communicate with any other device.
This means a customer with basic network scanning tools can see your POS terminal's IP address. A compromised customer device (with malware) can attempt connections to your payment hardware. A malicious actor who knows what they're looking at can probe for vulnerabilities — especially on older POS hardware running outdated firmware.
You don't have to be targeted by a sophisticated attacker. Automated malware that spreads laterally across any accessible network doesn't care if it's a home, a restaurant, or a hospital.
The Solution: Three Separate Networks
Each VLAN gets its own WiFi SSID (or you can use the same SSID for staff and guest, but that's less common). Devices on VLAN 30 (guest) can reach the internet but cannot communicate with VLAN 10 (POS) or VLAN 20 (staff). Your firewall enforces these rules automatically.
What You Need to Implement This
- A managed switch — unmanaged switches can't do VLANs. You need a managed switch that supports 802.1Q VLAN tagging. Ubiquiti, Cisco, and Netgear Business all make affordable managed switches starting around $80-150.
- A firewall that supports VLANs — most business-grade firewalls do. If you're using the combo router from your ISP, you almost certainly can't do this without replacing it.
- An access point that supports multiple SSIDs — most enterprise-grade APs broadcast 3-4 SSIDs simultaneously, each tagged to a different VLAN.
How Long Does This Take to Set Up?
For a typical restaurant or small business that already has reasonable hardware, implementing proper network segmentation takes 2-4 hours including configuration, testing, and verification. If you need new hardware (managed switch, firewall replacement), add installation time for that. Most businesses we work with are fully segmented within a single visit.
Bonus: Segment Your IoT Devices Too
While you're at it — put your smart TVs, Roku boxes, digital signage players, and any other consumer IoT devices on their own VLAN (or on the guest VLAN). Consumer IoT devices are notoriously insecure and receive infrequent firmware updates. Keeping them isolated means a compromised smart TV can't pivot onto your staff network.
Is Your POS on the Same Network as Your Customers?
We fix this for restaurants and businesses across Salt Lake City. Free assessment — we'll check your current setup and tell you exactly what needs to change.
Schedule a Free AssessmentOr call: 951-525-5858