It's always a nice thing to find an open WiFi hotspot when you're out and about and it would be swell to play that forward and setup an open, informal WiFi hotspot of your own. Your visitors will appreciate it, certainly, but on the other hand you don't want to open your own LAN for just anyone to access.
It's pretty easy to set up an informal, but separate, "walk-in-and-use-it" WiFi hotspot that vistors can use to connect to the internet but that won't overtly expose your LAN connected computers, servers and printers to your guests.
All that you need to do this is a WiFi router set up to run a WiFi LAN that is separate from your home or business LAN.
Note please that I'm not using the word "secure" for this. If you truly require a definite and secure separation between your main LAN and the one that your guests will use, you'll need a more rigorous, complex and costly solution. But if "separate" is OK for your need, then this is the way to go.
Parts needed: an extra WiFi router. That's it.
Fancy or cheap -- doesn't matter. In fact, it may be easiest and cheapest to buy a surplus "B" class router on eBay or Craigslist. "B" class is fast enough for casual internet access to check email or make a Google search. Setting your guest LAN to run as class "B" has a couple other benefits too, but we'll touch on those later.
The Quick How-to: (a more detailed set of steps is below.)
1. Get an extra WiFi router. We'll call this the "guest" router.
2. Set the guest router to run a LAN with an IP address that is separate and distinct from your home or business LAN.
3. Set an SSID "name" in your guest router that is easy to identify, like: "Myco Guest WiFi" or some such. Make sure that WiFi security is turned off.
4. Connect the new "guest" router's WAN port to the LAN side of your main LAN's router. Let it acquire -- or assign it -- an address on your main LAN.
Turn it on and test. You should be able to connect to your "guest" LAN now. If so; all done. If not; try the more detailed steps below.
The more detailed How-to. Basically the same as above; just filled out a bit more.
1. Buy an extra WiFi router. Note: NOT a WiFi access point ("AP") but a full on WiFi router. (This is usually cheaper than an AP anway.)
This is your "guest" router. It is "extra" because this one is in addition to and separate from your main LAN router.
You don't have to spend a lot if you don't care about special features. You don't have to worry about the B, G or N level for a guest connection because, you'll probably force it to "B" for maximum compatibility among your guests. (More on this below.)
NOTE: if you want to do things like limit bandwidth for guests or prevent them from visiting certain URLs, many routers will support that sort of thing but not all -- so look for those features in the router before you buy.
2. Secure your existing WiFi LAN. You should do this anyway, but if you haven't already done so, go into your WiFi router settings right now and set some level of security/access control.
While you're checking the settings in your router, check these and write them down for reference below:
-- The LAN address of your router. Chances are that you used it to get access, but if not, find it and write it down. Note: this is the internal LAN address and not the external WAN address that is provided by your ISP. The LAN address probably starts with 192.168....
-- The LAN subnet mask.
-- The LAN DHCP range, if DHCP is enabled.
-- The SSID of your WiFi network. This is the name that you see in a list of available WiFi access points.
3. Configure the guest router before connecting it to your network.
Use an ethernet cable to connect the new router to your computer and set it up before it connects to the rest of your LAN or to the internet.
These are the settings that you need to check and set:
++ The WAN address: set this to an address on the LAN that your main router controls. That's the LAN address range that you checked in step one above. It's not critical, but try to give it an address outside of the DHCP range that your main router uses.
That is: if the LAN address of your main router is, say, 192.168.0.1 and its DHCP range is from ...0.10 to ...0.100, then set the WAN address on your guest router to 192.168.1.120 or something like that. (Make sure that its an address that no other device is already using. Use a LAN scanning utility to check your LAN if you're not sure.)
++ WAN Subnet Mask: set it to match the LAN on the main router.
++ WiFi: make sure that it turned on.
++ WiFi security: make sure that it is turned off in your "guest" router.
++ WiFi service class: you'll have a choice of "Auto" (or something meaning that) or something like "G only" or "N only" or "B/G/N": try to find the "B only" setting. Use that if it is available. If b-only isn't available, use the closest setting to that.
This low setting may seem counter intuitive, but by forcing your router to the lowest common denominator you'll be saving your guests connection hassles when different service class devices try to connect to your router. The good news is that B class is faster than most DSL or 3G connections anyway.
++ SSID "name". Set this to something that is easy for visitors to recognize. Your business name, "guest", something easy. It will show up in the list of available networks on their devices as both open and friendly. IMPORTANT: this must be different from the SSID of your main LAN.
4. Connect the guest router to your main LAN router. You need to connect the WAN port on your guest router to the LAN side of your main router.
That's it. Turn it all on and your guests are ready to go.
How can this be safe?
If a router's function is to route then why wouldn't I be able to ping from a "supposedly secure IP range" to my main network range on the primary router?