Wi-Fi with guest network

Question

I use an old AirPort Extreme to provide WiFi in my home. It provides a 2.4 and 5.0 GHz network with a good password, only available to me and my wife. It also provides a separate guest network without password. The benefit is that visitors can have WiFi in my home without needing my password so I don’t need to hand my password out.

Question: Does the ability of a stranger to connect to the guest network put my password protected network at risk? Of course they can cause mayhem on the guest network, but would my main network using the same router be in danger, actual or theoretical?

PS. Thanks for all the answers. My plan was to enable friends and family to use Wifi, but not giving them a password which would be dangerous if one of them is a hacker, more dangerous is one of them is careless and gives the password to a real hacker, and inconvenient because changing the password is a pain if a friend becomes an ex-friend.

Apple has a feature where your phone can send the password to another phone if you allow it, so that phone can connect to your network, but the user cannot find out the password. Small improvement.

So the problems are: Anyone near my home can use my WiFi (I've heard a claim that someone in an apartment block could see 37 networks on their Mac!!!, so you could have 37 people able to log in). Not that big a problem because I can throw them out, but still. And the other problem: Someone who has access to an actual network on my router, meaning my router has to process their network traffic, may have more access to vulnerabilities in the router than someone who just parks their car near my network with nothing opened.

Answer 1

There is no inherent unavoidable risk in this approach which would put your private WiFi in danger. But ...

These networks are served by the same router. This means their implementation and configuration are only separated by software. And software can have bugs. For example if the attacker manages to exploit your router from the guest network, then this would likely enable the attacker to hijack your private network too.

Note that this scenario is not be that far fetched, since critical bugs in WiFi drivers, routers etc are not uncommon. The market for routers is usually not driven by best security, but by most features for lowest price.

Answer 2

I think that besides the technical security risk (which probably is not that critical if the system only works for your visitiors and you trust them), the major problem will be that anybody near your home can use that network.

This means, even if your hard- and software don't have any flaws, the next guy from the street could use your WiFi to perform illegal actions for which you will be held responsible.

And there are people that scan for such freely usable networks, probably even sell that information on a black market. With those kind of "users" the technical side also becomes critical again.

So: set a password for your guest network, and create a QR-Code for that. And change the password regularly (maybe every 3 months?). The QR-Code will make it more convenient for your visitors to log in. (You could use an open network with a gateway page to enter the password, like other WiFis in public places use, but I personally find that a bit of a chore both for the maintainer - you - and the user - your visitors. In the end they don't have to accept any written terms or whatsoever.)

Answer 3

As mentioned in the other answers, all bets are off if your router has a vulnerability which a malicious user is able to exploit.

Notwithstanding, it sounds like what you are looking for is network segmentation, where devices on the guest network cannot see or access devices on the main network, and vice versa. This can be done by creating two separate VLAN's - one for the main network and one for the guest network. Then, it will appear to users on the guest network that they are the only ones on the network, and likewise for users of the main network. Devices on one network will not be visible or accessible to devices on the other network. See https://www.routersecurity.org/vlan.php for a good write-up on this subject.

But, it bears repeating that the above configuration could fail spectacularly if the router has a vulnerability that can be exploited by a user on the guest network.

Answer 4

You can check if your router has a known vulnerability if you look at the common vulnerabilities and exposures site of the product. The higher the number, the more dangerous. 10 is the maximum.

An attacker could check this and try to use it. A 9-10 is a critical one and easy to use with a high impact.

In your scenario this could be for example access to your router administration interface. If you already opened a network for guests without password the attacker could use this.