Start your EVOTECH request in under a minute.
Business Wi-Fi Guest Isolation Setup in Houston, TX 77019
In 77019 the visitor is usually sitting in the same room as the server. A client waiting in a parlour that is now a lobby, an appraiser in a 1930s bungalow off Fairview, a vendor in a River Oaks design studio — each asks for the Wi-Fi password, and in most small offices here that password puts them on the identical network as the accounting machine.
A client on your sofa is eight feet from your file server
The professional stock in this ZIP is small and close-quarters. Law practices, wealth advisors, designers, galleries and aesthetics clinics occupy converted houses along Fairview, West Gray and the Montrose fringe, plus tenant suites near Allen Parkway. Head count is often under fifteen, and there is no server room — there is a closet, or a shelf above the copier.
On a flat network every device can reach every other device by design. The visitor’s laptop sits on the same address range as the drive holding client files, the copier that keeps scanned documents in its own memory, the camera recorder, and the gateway whose admin page still answers with the password on its sticker.
Nothing needs to be malicious. A contractor’s tablet carrying an old worm, a guest phone set to back up over any open link, a vendor laptop running discovery so it can find a printer — all behave as designed, and all see more than they should. Isolation is the structural fix: a way onto the internet with no route to anything of yours.
Three different things people call “guest isolation”
When an owner says “we already have a guest network,” they usually mean one of three controls. They do different jobs and are not interchangeable.
| Control | What it genuinely blocks | What it does not touch |
|---|---|---|
| Client (AP) isolation | One wireless device talking directly to another on the same SSID | Anything reached through the router — servers, printers, cameras |
| Guest VLAN with firewall policy | Guest traffic toward your internal address ranges and the gateway’s admin interface | Ordinary internet access, which still works normally |
| DNS or content filtering | Lookups for known-bad and blocked categories | Traffic using encrypted DNS elsewhere, unless that is handled too |
A real build uses all three, and the VLAN does the heavy lifting: visitors land in their own range, permitted out to the internet and denied toward private address space — the 10, 172.16 and 192.168 ranges — in both directions.
Two rules get forgotten most. First, denying guests the gateway’s management ports: a visitor who can load the router login screen holds the keys to every other rule. Second, restricting guests to the gateway alone for DHCP and DNS. We also drop outbound port 25 from the guest range, so a compromised laptop cannot turn your address into a spam source and take your business mail reputation with it.
Offices that used to be houses, and where cable can actually go
Most commercial space here was built as housing, and that shapes the install more than the equipment list does.
- Pier-and-beam crawl spaces. Older Neartown stock gives a genuine route from the front of the house to a back closet. It also holds moisture and decades of abandoned wiring, so runs get supported properly rather than draped over ductwork.
- Attics closed off by additions. The route that looks obvious on a floor plan is often blocked by framing nobody can see until they are up there.
- Garage apartments used as a second suite. That is a separate structure, and a link to it is protected where the cable enters — not just pushed through a hole.
- Street elevations you cannot mark. Exterior conduit on the public side is off the table. Work goes inside, through closets and under floors, or it does not happen.
Two placement calls are worth arguing about. Access points belong on the ceiling of the central hall, not in the corner office where the router happened to land. The switch belongs in conditioned space — not the detached garage, where a Houston August cooks a power supply and leaves an intermittent fault that takes three visits to chase.
Confidential work and a shared password in the same room
Practices in this ZIP hold material they have a duty to protect: case files, financial statements, design documents under NDA, appointment records. Isolation is the technical half of that duty. The policy half — what you keep, how long, who may see it — belongs to you and your own advisors, and we do not pretend otherwise.
Where isolation stops is worth stating. A separate segment protects your systems from visitors. It does not encrypt a guest’s own browsing, and it does not protect one visitor from another on a wide-open network. In a small office with few, known visitors, a WPA2 or WPA3 passphrase on a printed card is the right balance: everything on air is encrypted and the card changes in a minute when a contract ends. Enhanced Open encrypts a no-password network, but device support is still uneven, so we suggest it only where we can test it against the devices that will use it.
Worth writing down: a guest passphrase that has never changed is a staff passphrase. Every former employee and every contractor who worked a week still has it.
Plaster over metal lath, and why one router never covers the house
Pre-war construction here commonly uses plaster applied over metal lath — a sheet of metal mesh inside the wall, and close to a perfect screen for Wi-Fi. Two of those walls between the router and the back office is the difference between a strong link and an unusable one.
The higher band suffers most. 5 GHz carries more capacity but loses more signal through material, so every phone in the building drops to 2.4 GHz, where three non-overlapping channels are shared with the neighbours and everything else in the band. Guests then report slow Wi-Fi, the office calls the internet provider, the circuit tests clean, and the ticket closes. The circuit was never the problem.
The answer is coverage, not power. Two or three ceiling access points on one network name, each with its own cable back to the switch, beat any amount of boosting from one box in the front room. We set a minimum signal threshold so a phone two rooms away lets go rather than clinging to a weak link and slowing the radio for everyone. Repeaters chained through the same plaster are the one approach we will not install here — each hop halves throughput and the plaster already took most of it. Newer infill brings foil-faced sheathing, which behaves much the same way.
Five minutes to find out whether your guest network is real
Check this before you call anyone. Join the guest network on a laptop and work through the list; the described result is what a correctly isolated network does.
- Type your gateway’s address into a browser. A login page means visitors can reach your router’s admin interface. It should simply time out.
- Try the copier’s web page by its address. If it loads, visitors can read the device queue and often the stored scan history.
- Open the network drive, by name and by address. Either succeeding means the segments are not separated at the routing layer.
- Open the screen-sharing menu in the conference room. If the display appears, discovery traffic is crossing between segments — usually because both names share one address range.
- Put a second phone on guest and try to reach the first. Success means client isolation is off and visitors can see each other.
- Confirm ordinary browsing still works. A network that blocks everything is not isolated, it is broken.
If one through five failed the way they should and six worked, your setup is sound and you do not need us. If any of the first five succeeded, the guest network is decorative.
What the visit looks like, step by step
- Walk the building with a survey tool and mark where visitors actually sit — waiting area, conference table, courtyard. Signal gets measured where it is used, not from the closet.
- Write the list of what guests must never reach: network drive, copier, camera recorder, door controller, card terminal, and the gateway. That list becomes the firewall policy and you keep a copy.
- Test whether your gateway can do VLANs at all. Many provider boxes cannot, and their guest toggle only isolates clients on one radio. This finding decides whether the job is a configuration or a replacement, and we establish it before quoting.
- Design the addressing: separate ranges for staff and guests, a lease short enough to recycle addresses, and a per-device rate limit so one visitor’s video does not flatten the office connection.
- Run, terminate and test the cable to each access point location, then label both ends.
- Attack our own work. We join as a visitor and try every item from step two. The job is finished when the attempt fails, not when the configuration screen says applied.
- Leave one page of documentation: network names, how to change the guest passphrase without calling anyone, what the rules block, where the equipment lives.
What moves the number in 77019
We quote itemised after seeing the building, and never over the phone — the cable path is the variable here and you cannot see a crawl space from a phone call.
- Whether the existing gateway can enforce policy. Reusing a capable one is cheapest; replacing a provider box that cannot segment is honest.
- How many access points the walls demand. In plaster buildings that is driven by wall count, not floor area. A compact bungalow can need more units than an open suite twice its size.
- The route. A usable crawl space is straightforward. No path at all means surface raceway chosen to disappear against the trim, or a core through masonry.
- Switch and power budget: powered ports for the access points, spare capacity for a camera or door reader later, and whether an existing switch stays.
- Welcome page or plain passphrase. A branded landing page with terms of use is more setup, and plenty of offices here genuinely do not need one.
- Scope worth adding: if the camera recorder and door controller are also on the flat network, segmenting them during the same visit costs far less than a second trip.
- Working hours. Offices that cannot be interrupted during appointments get evening or weekend work, scheduled in the quote rather than discovered on the day.
The four callbacks we see in Neartown offices
- A second router nobody mentioned. Someone bought a consumer unit for the back office and plugged it into a wall jack. It bridges past every rule and hands out its own addresses.
- Isolation enabled on one access point only. On several platforms the setting applies per device rather than network-wide, so the front unit is locked down and the back hall is open. A visitor walking to the conference room silently changes which rules apply to them.
- Screen sharing broke, so somebody switched isolation off. This is the most common way a correct build gets undone. The right answer keeps the conference display on the staff side with a controlled path to it.
- The passphrase on the whiteboard. Unchanged since the office opened, visible in every photo taken in that room. We leave a change procedure a non-technical person can run in a minute, because a control nobody can operate is a control nobody uses.
Related services
Frequently asked questions
Is a separate network name the same thing as guest isolation?
No. A network name is a label. Two names can land on exactly the same address range, in which case a visitor on the guest name still reaches every device on the staff name. Isolation is what happens underneath: a separate segment with rules that block the route.
Can the router my internet provider gave me do this?
Sometimes partly, rarely fully. Many provider boxes offer a guest toggle that keeps devices from seeing each other on one radio but cannot create a separate segment or enforce rules toward your own equipment. We test the unit in front of us rather than assuming.
Will isolating guests break screen sharing in our conference room?
Yes, and that is the control working correctly — discovery traffic does not cross between segments. We keep the conference display on the staff side and give staff a clean path to it. Visitors who present get a cable to the display, which is faster anyway and never drops mid-meeting.
Our suite is in a leased building near Allen Parkway. Does that change the approach?
It can. In leased space we first establish whose circuit it is, where the building hands service off to your suite, and what is permitted inside the risers and above the ceiling. If internet arrives through the landlord there is a real question about what you may control, and we answer it before designing.
How often should the guest passphrase change?
Quarterly is a sensible floor, and immediately after any staffing change or when a contractor finishes. What matters is that the procedure is simple enough to actually happen, which is why we leave written instructions rather than keeping it as something only we can do.
Can you work around client appointments?
Yes. Most offices in this ZIP cannot have visitors walking past ladders, so cable pulls and cutover happen evenings or weekends. That gets scheduled in the quote.
Free on-site assessment in River Oaks and Neartown
Run the five-minute test above. If your router’s login page loads while you are on the guest network, call us — we will map what visitors can currently reach and give you an itemised quote before anything is committed. (832) 359-2425.
Book a Free Consultation
Ready for EVOTECH to help?
Before you leave, send the quick version. We will review the page you came from and reply with the clean next step.