[{"data":1,"prerenderedAt":81},["ShallowReactive",2],{"blog-post:en:\u002Fen\u002F2026-10-15-hotel-admin-part-3":3},{"id":4,"title":5,"body":6,"description":72,"extension":73,"meta":74,"navigation":76,"path":77,"seo":78,"stem":79,"__hash__":80},"content\u002Fen\u002F2026-10-15-hotel-admin-part-3.md","A developer somehow ends up running hotel IT. Part 3: Moving the hotel’s guest Wi-Fi to a separate VLAN",{"type":7,"value":8,"toc":68},"minimark",[9,18,25,28,31,34,37,40,43,50,53,56,59],[10,11,12,13,17],"p",{},"When I first started figuring out the hotel's network, it turned out that pretty much everything lived on one big LAN: ",[14,15,16],"code",{},"192.168.0.0\u002F23",". That's about 512 addresses. Servers, workstations, cameras, network equipment. And guest Wi-Fi too.",[10,19,20,21,24],{},"So someone checks into a room, connects to Wi-Fi, and technically ends up on roughly the same network as most of the hotel's infrastructure. A little worrying! I decided to move guest Wi-Fi to a separate VLAN 50 with its own ",[14,22,23],{},"10.50.0.0\u002F23"," subnet, allowing access only to the internet.",[10,26,27],{},"Sounds simple:",[10,29,30],{},"create a VLAN → select it in UniFi → done.",[10,32,33],{},"Of course not. My gateway actually runs as a virtual machine in Proxmox. So first I had to pass the VLAN from the physical switch into Proxmox, add a separate network interface to the Linux gateway VM, and configure DHCP, routing, and the firewall. Then I had to carry that same VLAN through the hotel's entire physical network to every access point serving guest Wi-Fi. That was the most time-consuming part, because it meant knowing the whole network topology: which switch sits behind which, whether it's managed, and whether it supports VLAN tagging.",[10,35,36],{},"The path included a pretty eclectic collection of managed and unmanaged switches that I was only just starting to understand myself. So I tested everything on a single access point with a temporary SSID first, leaving the working guest network alone.",[10,38,39],{},"A very pleasant way to learn about tagged and untagged VLANs:",[10,41,42],{},"not on a lab bench, but in a working hotel with guests using the network right now.",[10,44,45,46,49],{},"After testing, I moved the production ",[14,47,48],{},"Bristol-Guest"," network to the new VLAN.",[10,51,52],{},"Guests kept their internet access but lost access to servers, workstations, cameras, telephony, and the network equipment's management interfaces. I also isolated guest devices from one another.",[10,54,55],{},"I think that was the moment I first realised that “I help out a bit with the hotel's infrastructure” no longer quite described the situation.",[57,58],"hr",{},[10,60,61,62,67],{},"Previous part: ",[63,64,66],"a",{"href":65},"\u002Fen\u002Fblog\u002F2026-09-07-hotel-admin-part-2\u002F","Part 2: Replacing the core switches and trying not to break anything",".",{"title":69,"searchDepth":70,"depth":70,"links":71},"",2,[],"Moving guest Wi-Fi to VLAN 50: Proxmox, a Linux gateway, DHCP, firewall rules, and a path through every switch to the access points.","md",{"date":75},"2026-10-15",true,"\u002Fen\u002F2026-10-15-hotel-admin-part-3",{"title":5,"description":72},"en\u002F2026-10-15-hotel-admin-part-3","CVxYgqzeTlmiad0ej25xnCZqHFPl3vFCvYa3Uqj8FJk",1792059653597]