OPENWRT GUEST WI-FI | Create a Separate Network for Visitors and Smart Devices

Giving visitors your main Wi-Fi password can expose more of

your home network than you intend. A guest network helps you provide internet access without giving every connected device unrestricted access to your computers, printers, shared storage, and other local devices.

OpenWrt lets you create a separate wireless network and use firewall rules to control what connected devices can reach. You can use this feature for visitors, and—with a little additional planning—for smart devices such as plugs, bulbs, cameras, and other Internet of Things (IoT) equipment.

In this tutorial, you’ll learn how to create a guest Wi-Fi network through OpenWrt’s web interface, secure it with a password, restrict access to your main network, test that the separation works, and troubleshoot common problems.

Important: A different Wi-Fi name alone does not create a secure separate network. Proper network-interface configuration and firewall rules are essential. The instructions below are based on the official OpenWrt guest Wi-Fi documentation. Menu names and available options can differ between OpenWrt versions and router configurations.

What you need before you start

Prepare the following:

• An OpenWrt router that is already configured and providing internet access.
• Access to the router’s LuCI web interface.
• The administrator username and password for your router.
• A phone or computer connected to your existing network.
• A new Wi-Fi name (SSID) for the guest network.
• A strong password for the new wireless network.
• A little time to test the configuration before allowing visitors or smart devices to use it.

You should also understand whether your OpenWrt device is the main router or a secondary wireless access point.

This distinction matters. The main-router procedure in this tutorial assumes OpenWrt manages your local network, DHCP services, and internet-facing firewall. If your OpenWrt device is configured as a bridged or “dumb” access point behind another router, the network and firewall configuration differs. Use the appropriate official OpenWrt guide for a dumb access point instead of blindly following main-router instructions.

1. Back up your existing OpenWrt configuration

Before changing network settings, create a backup so that you have a recovery option if something goes wrong.

1. Connect to your existing Wi-Fi or, preferably, use an Ethernet connection to the router.
2. Open your router’s LuCI address in a web browser. The address varies by configuration; a common default is http://192.168.1.1.
3. Sign in using your administrator credentials.
4. Open System and look for the backup or configuration-backup option. The exact location depends on your OpenWrt version and installed interface components.
5. Download the configuration archive and store it somewhere safe.
6. Keep your current router access method available while you work.

Do not restore an old configuration unless you understand what it will replace. A full restore can overwrite changes made since the backup.

If possible, perform the configuration while connected by Ethernet. Incorrect network changes can disconnect your current Wi-Fi session, and an Ethernet connection can make recovery easier.

2. Choose a name and address range for the guest network

Plan the guest network before creating it.

For example, you could use:

• Wi-Fi name: Home-Guest
• Network interface name: guest
• Bridge device name: br-guest
• Router address on the guest network: 192.168.3.1
• Guest subnet: 192.168.3.0/24

These are illustrative values, not universal settings. Your guest subnet must not overlap with the address ranges used by your existing LAN, WAN, VPN, or other networks. If your router already uses 192.168.3.0/24, choose a different unused private subnet.

The Wi-Fi name is what people see when connecting. The interface and bridge names are internal identifiers used by OpenWrt.

3. Create a separate bridge device

A bridge provides the network connection point to which the guest wireless interface will be attached.

1. In LuCI, open Network → Interfaces → Devices.
2. Select Add Device Configuration or the equivalent option shown in your version.
3. Choose Bridge device as the device type.
4. Enter br-guest as the device name.
5. If the option Bring up empty bridge is available, enable it. This is useful when the guest network may use more than one wireless radio.
6. Do not add your existing LAN Ethernet ports to this bridge.
7. Save the configuration.

If your interface does not expose these options, consult the official OpenWrt guest Wi-Fi guide using LuCI for the version and configuration you are running.

Check before continuing: The new bridge should be separate from your existing LAN bridge. Do not repurpose the main LAN bridge to create a guest network.

4. Create the guest network interface

The guest interface gives the new network its own IP address and allows OpenWrt to manage its traffic separately.

1. Open Network → Interfaces.
2. Select Add new interface.
3. Enter guest as the interface name.
4. Choose Static address as the protocol.
5. Select br-guest as the device.
6. Create the interface and enter an unused address range.

For the example configuration, use:

• IPv4 address: 192.168.3.1
• IPv4 netmask: 255.255.255.0

These values represent the router’s address on the guest network and a subnet with room for guest devices. Use a different subnet if necessary to avoid conflicts.

7. Open the interface’s Firewall Settings tab.
8. Assign the interface to a new firewall zone named guest, or create that zone if the interface offers the option.
9. Save the settings.

Do not assign the guest interface to your existing lan firewall zone if your goal is to isolate guest devices from the main network.

5. Enable DHCP for the guest network

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices joining the guest network.

Without a working DHCP configuration, a visitor’s phone might connect to the Wi-Fi name but fail to obtain a usable network address.

1. Edit the guest interface.
2. Open its DHCP Server tab.
3. If DHCP is not configured, select Set up DHCP Server or the equivalent option.
4. Keep an appropriate address pool and lease duration for your network. The default values are often sufficient for a small home network.
5. Save the configuration.

OpenWrt commonly manages DHCP through its dnsmasq service, but installations can differ. If your router has DHCP or DNS listening restrictions, confirm that the guest interface is included where necessary.

Do not disable the DHCP service used by your existing LAN simply to configure the guest network.

6. Configure the guest firewall zone

This is one of the most important parts of the setup. The firewall determines whether guest devices can communicate with the router, the internet, and your private network.

1. Open Network → Firewall.
2. Find the guest zone created for the guest interface.
3. Select Edit.
4. Check that the zone includes the guest interface and uses the following general policies:

Firewall setting	Recommended policy	Purpose
Input	Reject	Prevents unrestricted access from guests to services on the router
Output	Accept	Allows the router to send traffic toward guest devices when permitted by other rules
Forward	Reject	Prevents unrestricted forwarding from guests to other networks

These policies are a starting point, not a complete firewall configuration by themselves.

Allow internet access without allowing access to your main LAN

The guest network needs a permitted route to the internet, but it should not have unrestricted forwarding to your private LAN.

1. In the guest zone settings, locate Allow forward to destination zones or the equivalent forwarding control.
2. Permit forwarding from guest to wan if wan is the internet-facing firewall zone on your router.
3. Do not permit forwarding from guest to lan unless you have a specific, understood requirement and have configured appropriate restrictions.
4. Save and apply the settings.

If your router uses a different upstream arrangement, the destination zone may not be named wan. Confirm the actual topology before selecting a destination.

Allow essential DHCP and DNS traffic

Devices usually need DHCP to obtain an IP address and DNS to resolve website names.

OpenWrt’s official guest-network procedure includes narrowly scoped firewall rules for DHCP and DNS requests from the guest interface. Depending on your configuration, these may already be created or may need to be added.

Review the official Guest Wi-Fi using LuCI guide and ensure the guest network can reach the services it needs without granting broad access to the router or main LAN.

Do not solve a DNS or DHCP problem by allowing all traffic from the guest network into your main LAN. Correct the specific rule or service configuration instead.

7. Create the guest Wi-Fi network

Now that the separate network and firewall zone exist, create the wireless network that visitors will see.

1. Open Network → Wireless.
2. Choose Add beside the radio you want to use.
3. In the wireless interface configuration, enter your chosen network name, such as Home-Guest, in the ESSID or network-name field.
4. Set the mode to Access Point if the interface asks you to select a wireless mode.
5. Under the network or interface assignment field, select guest.
6. Open the Wireless Security section.
7. Choose a supported, secure encryption option. Prefer WPA3-Personal where your devices support it, or WPA2-PSK with AES/CCMP where WPA3 is not practical. Avoid obsolete or insecure security modes.
8. Enter a strong, unique Wi-Fi password.
9. If an Isolate Clients option is available, enable it if you want wireless guest clients on that interface to be prevented from communicating directly with one another.
10. Save the wireless configuration and select Save & Apply.

The guest Wi-Fi should be associated with the guest network—not your existing lan network.

Do not create an open, password-free guest network just for convenience. A password helps prevent nearby strangers from joining your network. If you need to give visitors access, share the guest password rather than your primary Wi-Fi password.

Should you use both 2.4 GHz and 5 GHz?

That depends on your router and the devices you want to connect.

• 2.4 GHz often provides better range through walls and supports many older smart devices.
• 5 GHz can offer higher performance at shorter distances, but its coverage may be more limited.
• Some routers support additional bands, and the available options depend on the hardware and wireless configuration.

You can create a guest wireless interface on another supported radio and attach it to the same guest network, provided the configuration supports it. If you do, check the client-isolation settings on every guest wireless interface you create.

8. Save the changes and confirm that the network is active

After applying the configuration, return to Network → Interfaces and check the guest interface.

Confirm that:

• The guest interface exists.
• It is associated with the intended bridge device.
• Its IP address is the one you configured.
• The guest wireless interface is enabled and associated with guest.
• DHCP is available to guest clients.
• The guest firewall zone is present.
• Forwarding to the intended internet-facing zone is configured.

If the router reports configuration errors, resolve those before connecting visitors’ devices.

The exact status indicators vary across OpenWrt versions. An interface appearing in the list does not, by itself, prove that internet access and isolation work correctly.

9. Test the guest network from a phone or computer

Use a device that is not essential to your router administration. Keep your main connection available in case you need to correct the configuration.

Test A: Connect to the guest Wi-Fi

1. Open the Wi-Fi settings on your phone or computer.
2. Select Home-Guest, or the name you chose.
3. Enter the guest password.
4. Wait for the device to connect.
5. Check the network details to see whether it received an IP address in the guest subnet.

With the example settings, a guest device might receive an address such as 192.168.3.100. The exact address depends on your DHCP pool.

If the device connects to Wi-Fi but has no usable IP address, investigate DHCP and the guest interface before changing unrelated firewall settings.

Test B: Confirm internet access

1. Open a web browser on the guest device.
2. Visit a familiar website.
3. Try another site if the first one fails.
4. If websites do not load, check whether the device received an IP address and whether DNS resolution works.

If the guest network cannot access the internet, review the guest-to-WAN forwarding, DHCP, DNS, and upstream connection settings.

Test C: Check isolation from the main network

A separate Wi-Fi name does not prove that the guest network is isolated.

1. Connect one device to the guest Wi-Fi.
2. Identify a device on your main LAN that you own and are authorized to test.
3. From the guest device, attempt to reach that device using a known local address or service.
4. Confirm that access to services that should remain private is blocked.
5. Check that internet access still works.

Do not rely only on whether a printer, computer, or router login page appears in a device-discovery list. Discovery protocols can behave differently across networks. Test the actual access paths that matter.

Also remember that the firewall’s Input policy controls traffic directed at the router, while its Forward policy controls traffic passing through the router. If you want to restrict access to the router’s own management interface, verify that restriction separately.

For a more thorough check, consult the testing guidance in the official OpenWrt Guest Wi-Fi basics.

10. Decide how to handle smart devices

Guest Wi-Fi can be useful for untrusted smart devices, but not every IoT device works correctly when placed on a fully isolated network.

A smart bulb, camera, speaker, or plug may require an app on your phone to discover it locally. If your phone is on the main LAN and the smart device is on a strictly isolated guest network, that local discovery or control may fail.

Consider the following options:

• Visitors’ phones and laptops: A guest network with internet access and restricted access to your private LAN is usually appropriate.
• Simple internet-connected smart devices: A separate IoT network can reduce their exposure to computers and personal devices.
• Smart devices that need local control: You may need narrowly scoped firewall rules, a supported discovery relay, or another deliberate network design.
• Devices that should not reach the internet: Use a separate policy that blocks internet access while allowing only the communications genuinely required.

Do not assume that placing every smart device on the same guest network automatically makes the setup both secure and functional. Some devices need communication with one another, while others should be isolated from all other clients.

For additional guest-network controls, see OpenWrt Guest Wi-Fi extras.

11. Troubleshoot common problems

Problem	What to check
Guest Wi-Fi name is missing	Confirm the wireless interface is enabled, attached to the correct radio, and configured with a valid network name. Check the radio and wireless status.
Device connects but receives no IP address	Check that the guest interface is up, DHCP is enabled on the correct interface, and the DHCP service is listening where required.
Device gets an IP address but cannot browse	Check guest-to-internet forwarding, upstream connectivity, DNS, and any restrictive firewall rules.
Internet works but local devices are reachable	Review firewall-zone membership and forwarding rules. Confirm the guest interface was not accidentally assigned to lan.
Internet works but local smart-device control fails	Check whether the application requires local discovery or communication between networks. Add only the necessary, carefully scoped access.
Some guests can connect but others cannot	Check the password, wireless compatibility, DHCP pool capacity, signal strength, and client-isolation settings.
Guest devices can reach one another	Check wireless client isolation and whether multiple guest interfaces or wired connections require additional bridge or firewall restrictions.
Configuration changes disconnect you	Reconnect through Ethernet if possible, use the router’s recovery method if necessary, or restore the backup only when appropriate.

Change one setting at a time and test again. Broadly disabling the firewall, allowing unrestricted forwarding to the LAN, or removing network protections is not a good troubleshooting strategy.

12. Maintain the guest network securely

Once the network works, keep it secure with a few straightforward habits:

• Use a guest password that is different from your primary Wi-Fi password.
• Change the guest password when you no longer want previous visitors to have access.
• Keep OpenWrt and its installed packages updated through the appropriate supported update process.
• Use a strong administrator password and do not share router administration credentials with guests.
• Keep guest devices away from private services unless there is a clear reason to permit access.
• Review firewall changes after installing packages or making other network modifications.
• Test isolation again after major changes to the router, firewall, or wireless configuration.
• Keep a current backup of a working configuration.

Remember that client isolation, firewall-zone separation, and internet access are different controls. Client isolation can prevent devices on a wireless interface from communicating directly with each other, but it does not replace correct firewall rules between the guest network and the main LAN.

Your practical checklist

Before sharing the guest Wi-Fi password, confirm that:

• [ ] You backed up the OpenWrt configuration.
• [ ] The guest network uses a separate interface and subnet.
• [ ] The guest wireless interface is attached to the correct network.
• [ ] The guest network has its own firewall zone.
• [ ] Guests can reach the internet without unrestricted access to the main LAN.
• [ ] DHCP and DNS work correctly for guest clients.
• [ ] Wireless security is enabled with a strong, unique password.
• [ ] Client isolation is enabled where appropriate and supported.
• [ ] You tested access to important private devices and confirmed the intended restrictions.
• [ ] Any smart devices on the guest network still perform the functions you need.
• [ ] You know how to disable the guest wireless interface if you need to stop access temporarily.

Official OpenWrt resources

• OpenWrt — Guest Wi-Fi using LuCI: Step-by-step setup through the web interface.
• OpenWrt — Guest Wi-Fi basics: Explains network interfaces, DHCP, firewall configuration, and testing.
• OpenWrt — Guest Wi-Fi extras: Covers client isolation, wireless security, multiple radios, and other customizations.
• OpenWrt — Guest Wi-Fi using the command line: An alternative for administrators comfortable with SSH and OpenWrt’s UCI configuration system.
• OpenWrt — Guest Wi-Fi on a dumb wireless access point: Guidance for a secondary access point behind another router.

Final takeaway

A well-configured OpenWrt guest network gives visitors convenient internet access while reducing their ability to reach your private devices. The protection comes from separating the network interface, configuring the firewall correctly, securing the wireless connection, and testing the result—not simply creating another Wi-Fi name.

Your next step: Back up your router, create the guest network using the appropriate OpenWrt procedure, and test both internet access and isolation before sharing its password. 

Image: Purple Wifi