Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

How should I share my home network with a visitor?

If you have a wireless network and your friend brings over his
computer, how do you let them on your network as a guest without giving
out your wireless encryption key?

Time for my most popular … no, my most common, answer:

It depends.

It depends on how much you trust your friend.

And since you don’t want to share your wireless encryption key, I’m
going to assume that while you probably trust your friend to a point,
there’s clearly a limit.

]]>

If you trust someone completely, then when it comes to your home network you just give them the WPA encryption key. (As an aside: good for you for using an encryption key to keep your wireless connection safe.) (As a second aside: you’re not using WEP, right? That’s no longer secure; use WPA.)

Unfortunately most wireless equipment is set up to operate at either one extreme or the other: require an encryption key to connect, or let anyone connect. You don’t want to hand out your key, so your friend can’t connect that way, and you don’t want to reconfigure your wireless access point to remove all security, so you can’t allow him to connect that way either.

“In a nutshell, ‘split’ your internet connection using a hub or a switch …”

It’s not a simple problem to solve.

If you trust your friend “sort of” you could allow him to connect to your network via a wired cable. No encryption key is needed, and it’s likely you already have an open port on your router available. The risk is that he’s on your network at all. If you don’t have firewalls on all your machines (common, if you’re using a router as your single firewall for all) then his machine could carry malware that might travel to your machines, or he might even be able to poke around on your network in ways that you might not want him to.

Honestly, if there’s a question of trust at all, I don’t recommend it. There are just too many things that could go wrong.

So what do you do instead?

More hardware.

In a nutshell, “split” your internet connection using a hub or a switch (or a router) before it reaches your router, and put all of your equipment on one side protected behind your router, and then everyone else – your guest for example – on the other side:

Simple but Safe network sharing with a guest

This example above assumes that your ISP will give you more than one IP address – one for your router, and one for your guest. If that’s not the case you’ll need to replace the hub/switch in the example with another router.

Here’s the same setup, using wireless connections:

Simple but Safe network sharing with a guest - wireless version

Here you can see that the router on the left, your existing router I might add, continues to use a WPA key for wireless encryption. The router on the right is dedicated to your guests use, and can either be a completely open (no encryption, no key needed) hotspot that anyone can connect to, or you can set it up to use a different WPA key that you don’t mind sharing with your guests.

Using this setup, the two separate networks are isolated from each other. Neither can “sniff” the other’s traffic, and neither can access the other’s machines.

For the record, this is what I have in my own home: a private wireless network secured by WPA, and then a separate guest network that is open to anyone within range.

And as a fairly interesting side note, we are starting to see equipment that effectively bundles the equivalent of two routers and wireless access points into a single box, for exactly this scenario.

Now, there’s one final gotcha, that is once again a matter of trust.

Remember that your guest is using your internet connection. If they happen to do something, say, illegal … it can be traced by law enforcement, and that trace would lead to you as the owner of that connection. I’m guessing at that point you’d have some explaining to do.

Choose your friends, and your guests, wisely.

Subscribe to Confident Computing! Tech problem solving & safety tips & a weekly confidence boost in your inbox every week.

I'll see you there!

10 Reasons Your Computer is Slow

Slow Computer?

Speed up with my special report: 10 Reasons Your Computer is Slow, now updated for Windows 10.

NOW: name your own price! You decide how much to pay -- and yes, that means you can get this report completely free if you so choose. Get your copy now!

9 comments on “How should I share my home network with a visitor?”

  1. Well-explained, Leo. Instead of “additional” hardware, for simplicity I would suggest “replacement” hardware.

    Apple truly solved this problem in a very simple way. Guest networking in any new Airport Extreme. Two SSIDs, two separate networks, one device. Brilliant. Done right.

    Reply
  2. Why not just use MAC address filtering on your wireless router. Just add the friend’s MAC address to the list of allowed addresses. No WEP/WPA needed.

    As other have stated, MAC addresses are NOT secure. It’s trivial to spoof them. (And you do want your data encrypted, I think.)

    – Leo
    17-Apr-2009
    Reply
  3. Craig – MAC address can easily be spoofed to connect. And without WPA, all traffic between the PCs and router can be openly read by a listener.

    Reply
  4. Rahul: Yes, but to spoof a MAC address someone first needs to find a valid MAC address to use.

    And your traffic between PCs that are connected via ethernet cable isn’t encrypted either.

    MAC addresses are not encrypted even on encrypted connections, (technically they’re used at a layer below encrypted data), so all one needs to do is sniff the network, pick one of the MAC addresses that are obviously allowed to pass through, and choose that to spoof.

    And data on your ethernet cable isn’t being broadcast to a 300 ft radius of your wireless connection. 🙂

    – Leo
    17-Apr-2009
    Reply
  5. Leo: thanks for clarifying the pitfall of MAC address filtering.
    And point taken about WiFI being broadcast, but the discussion was in the context of allowing friends onto your LAN.

    My point about WiFi is that you should not remove encryption simply to allow a guest to connect. If you need encryption, you need encryption.

    – Leo
    19-Apr-2009
    Reply
  6. I have a DSL Router. The original one died and the computer store people (Best Buy) suggested I replace it with another one from Verizon. It still uses WEP and can’t, apparently, use WPA. As a DSL user are we stuck with old technology? What about FIOS fiber optic? If its router dies, can you buy a better one?

    This has nothing to do with DSL or FIOS or whatever technology you connect to the internet with. This is all about the router itself, nothing more nothing less. I’d check with your ISP for what your options really are, I can’t believe they’d force a WEP-only router on you. In many cases they don’t give or specify a router – they provide a modem which you then connect to whatever router you like.

    – Leo
    22-Apr-2009
    Reply
  7. I have a wireless gateway with four ports at the back, so if a friend brings over a notebook or whatever I just hook it up with a length of network cable. Much easier and quicker than configuring the wireless connection.

    Reply
  8. In scenario 2, would it be possible to use a G- series router for the guests’ usage without it affecting my encrypted N-series router? I remember reading previously that older router versions (ie G-series) can negatively affect the performance of newer ones. What effect can this have on wireless performance?

    Reply

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.