<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-wireless-guest-network-security
description: >-
  Secure wireless guest network implementation including network isolation, captive portal deployment, bandwidth management, VLAN segmentation, client isolation, and usage policy enforcement.
domain: cybersecurity
subdomain: wireless-security
tags:
  - guest-wifi
  - captive-portal
  - vlan-isolation
  - bandwidth-control
  - network-segmentation
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557", "T1200", "T1021"]
  nist-csf: ["PR.AC-5", "PR.AC-4", "PR.DS-5"]
  uuid: 5f03b31c-bd38-42a9-a7b2-5c9de1a71ec6
---

# Implementing Wireless Guest Network Security

## Overview

Guest wireless networks require careful security architecture to provide connectivity
while preventing lateral movement to corporate resources. This covers VLAN segmentation,
captive portal authentication, client isolation, bandwidth management, DNS filtering,
and logging requirements for guest network implementations.

Mode: `[MODE: ARCHITECT]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Managed wireless infrastructure with VLAN support | Required |
| Captive portal solution (nodogsplash, PacketFence, or vendor-native) | Required |
| DHCP and DNS services for guest VLAN | Required |
| Firewall with VLAN-aware rules | Required |
| Guest network usage policy approved by legal | Required |

## Key Concepts

### Guest Network Security Architecture

```
Guest Network Security Stack:
├── Network Isolation
│   ├── Dedicated VLAN (e.g., VLAN 100)
│   ├── Firewall rules blocking corporate access
│   ├── Client-to-client isolation (AP level)
│   └── Separate DHCP scope and DNS
├── Authentication & Authorization
│   ├── Captive portal with terms acceptance
│   ├── Sponsored guest access workflow
│   ├── Time-limited session tokens
│   └── Optional: SMS/email verification
├── Traffic Control
│   ├── Per-client bandwidth limits
│   ├── DNS filtering (malware/adult content)
│   ├── Protocol restrictions (block P2P, torrents)
│   └── Total SSID bandwidth cap
├── Monitoring & Logging
│   ├── Session logging (MAC, IP, duration)
│   ├── DNS query logging
│   ├── Bandwidth utilization tracking
│   └── Anomaly detection (tunneling, abuse)
└── Compliance
    ├── Legal terms of service acceptance
    ├── Data retention policy
    ├── Law enforcement disclosure requirements
    └── Acceptable use policy enforcement
```

### VLAN and Firewall Configuration

```bash
# Create guest VLAN (OpenWrt example)
uci set network.guest=interface
uci set network.guest.proto='static'
uci set network.guest.ipaddr='10.10.100.1'
uci set network.guest.netmask='255.255.255.0'
uci set network.guest.device='br-guest'

# Bridge guest VLAN
uci set network.br_guest=device
uci set network.br_guest.type='bridge'
uci set network.br_guest.name='br-guest'
uci add_list network.br_guest.ports='eth0.100'

# Guest WiFi interface
uci set wireless.guest_radio0=wifi-iface
uci set wireless.guest_radio0.device='radio0'
uci set wireless.guest_radio0.network='guest'
uci set wireless.guest_radio0.mode='ap'
uci set wireless.guest_radio0.ssid='Guest-WiFi'
uci set wireless.guest_radio0.encryption='sae-mixed'
uci set wireless.guest_radio0.key='GuestAccess2026'
uci set wireless.guest_radio0.isolate='1'
uci commit

# Firewall — block guest-to-LAN, allow guest-to-WAN
uci set firewall.guest_zone=zone
uci set firewall.guest_zone.name='guest'
uci set firewall.guest_zone.input='REJECT'
uci set firewall.guest_zone.output='ACCEPT'
uci set firewall.guest_zone.forward='REJECT'
uci add_list firewall.guest_zone.network='guest'

uci set firewall.guest_wan=forwarding
uci set firewall.guest_wan.src='guest'
uci set firewall.guest_wan.dest='wan'

# Allow DHCP and DNS for captive portal
uci set firewall.guest_dhcp=rule
uci set firewall.guest_dhcp.src='guest'
uci set firewall.guest_dhcp.dest_port='67-68'
uci set firewall.guest_dhcp.proto='udp'
uci set firewall.guest_dhcp.target='ACCEPT'

uci set firewall.guest_dns=rule
uci set firewall.guest_dns.src='guest'
uci set firewall.guest_dns.dest_port='53'
uci set firewall.guest_dns.proto='tcp udp'
uci set firewall.guest_dns.target='ACCEPT'
uci commit firewall
```

### Captive Portal Deployment

```bash
# Install and configure nodogsplash captive portal
opkg install nodogsplash

cat > /etc/nodogsplash/nodogsplash.conf << EOF
GatewayInterface br-guest
GatewayAddress 10.10.100.1
MaxClients 50
ClientIdleTimeout 30
ClientForceTimeout 480
AuthenticateImmediately no
RedirectURL https://guest-portal.example.com/terms
EOF

# Start captive portal
/etc/init.d/nodogsplash start
/etc/init.d/nodogsplash enable
```

### Bandwidth and DNS Controls

```bash
# Per-client bandwidth limiting with tc
tc qdisc add dev br-guest root handle 1: htb default 10
tc class add dev br-guest parent 1: classid 1:10 htb rate 10mbit ceil 15mbit
tc qdisc add dev br-guest parent 1:10 sfq perturb 10

# DNS filtering — redirect to filtered DNS
iptables -t nat -A PREROUTING -i br-guest -p udp --dport 53 -j DNAT --to 10.10.100.1:53
iptables -t nat -A PREROUTING -i br-guest -p tcp --dport 53 -j DNAT --to 10.10.100.1:53

# Block common abuse protocols from guest network
iptables -A FORWARD -i br-guest -p tcp --dport 25 -j DROP
iptables -A FORWARD -i br-guest -p tcp -m multiport --dports 6881:6889 -j DROP
```

## Workflow

### Step 1: Network Design

Design guest VLAN architecture with isolation from corporate resources.

```bash
# Plan IP addressing and VLAN assignment
echo 'Guest VLAN: 100, Subnet: 10.10.100.0/24'
```

### Step 2: Infrastructure Configuration

Configure VLAN, SSID, firewall rules, and DHCP for guest network.

### Step 3: Captive Portal

Deploy captive portal with terms of service acceptance.

### Step 4: Traffic Controls

```bash
# Apply bandwidth limits and DNS filtering
tc qdisc add dev br-guest root handle 1: htb default 10
```

### Step 5: Validation

Test isolation, captive portal flow, and bandwidth controls end-to-end.

## Detection

```yaml
title: Wireless Guest Network Security Detection
id: 6de38593-edc7-4969-9a59-5d80b1c750da
status: experimental
description: Detects suspicious activity related to implementing wireless guest network security techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1200
  - attack.t1021
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wireless Guest Network Security Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557, T1200, T1021 |

## Verification

- [ ] Guest VLAN isolated from corporate network (verified with nmap)
- [ ] Client-to-client isolation confirmed at AP level
- [ ] Captive portal enforces terms acceptance before access
- [ ] Per-client bandwidth limits enforced
- [ ] DNS filtering operational for guest network
- [ ] Session logging capturing MAC, IP, and duration

## References

- CIS Controls v8 — 12.5 Centralize Wireless Network Management
- NIST SP 800-153 — Guidelines for Securing Wireless LANs
- PCI DSS Requirement 1.2.3 — Segment Wireless from Cardholder Environment
- [nodogsplash documentation](https://nodogsplash.readthedocs.io/)
