Series 3: What is a Guest LAN and how do I set it up?

Beverly McRae

If you are not sure what Series CradlePoint router you have, please click here.
This article is written based on the 5.0.0 series 3 firmware version.

While it is nice to be able to provide complimentary Internet access to your customers or guests, it is important to be careful to keep important network assets secure from prying eyes.  Series 3 CradlePoint wireless routers support multiple wireless networks (SSIDs), allowing you to set up one or more Guest Networks.  The default “Guest LAN” is always present, but since its only interface (the Public-XXX wireless network) is disabled by default, it is effectively disabled until you activate an interface.

Enabling the Guest LAN allows you to have a separate wireless network with a different name and password (or no password at all) than your Primary LAN.  Additionally, you can prevent clients connected to the Guest LAN from being able to access the router’s administrative interface, or from interacting with other devices on the network.

Set Up:
First of all, let’s take a look at the default configuration for the Primary LAN:

DHCP Server:     Enabled
Routing Mode:    NAT
LAN Isolation:     No
Admin Access:    Yes
Ethernet ports:    lan, Port(s): 1, 2 3, 4
SSID:                    MBRXXXX-XXX  (the default SSID from the label on the bottom of the router)

The default “Guest LAN” is configured with these settings:

DHCP Server:     Enabled
Routing mode:   NAT
LAN Isolation:    Yes
Admin Access:   No
Ethernet ports:   None (see Notes at bottom of the article)
SSID:                    Public-XXX          (where the XXX is the last 3 characters of the device’s MAC address)


Click here if you are not sure how to access your router’s administrative interface.

The “Guest LAN” can be enabled during the First Time Setup Wizard by checking the Enable Guest Network option. This activates the Public-XXX wireless network that the Guest LAN uses by default. Note that this wireless network is configured by default to not require a password.

If you have already gone through the First Time Setup Wizard, or would like to reconfigure the Guest LAN, follow the directions below.

  1. Click on the Network Settings tab and select WiFi/Local Networks from the dropdown menu.  User-added image
  2. Locate the Guest LAN in the Local IP Networks section at the top of the page. Make note of the SSID for the attached WiFi Access Point interface for this network. We will need to know this in order to enable this wireless network shortly. In this example, the Guest LAN’s SSID is “Public-d55”.                                                            User-added image
  3. Scroll down to the Local Network Interfaces section. In the list of Wireless Access Points/SSIDs, locate the one we identified during step 2. Place a checkmark in the box next to it, and then click the Edit button just above it.User-added image
  4. In the Wireless Network Editor window that appears, place a checkmark next to the Enabled option. Feel free to change any of the other default settings for this guest WiFi network here as well, and then click Submit to apply the changes.User-added image
  5. Verify that the settings for your guest wifi network are correct.                                                        User-added image

After having the Guest LAN’s wireless network enabled as shown in the example pictures, the CradlePoint will be broadcasting two SSIDs – the WPA2 secure MBR1400-d55 network, as well as an open (unsecured) Public-d55 network. Wireless clients connecting to the unsecured Public-d55 network will belong to the Guest LAN instead of the Primary LAN. Devices on the Guest LAN obtain IP addresses that begin with 192.168.10.X do not have access to CradlePoint’s administrative console, and are isolated from each other.



Although there are no Ethernet ports associated to the Guest LAN by default, you may reassign specific Ethernet ports to be grouped with the Guest LAN (or any other LAN). For example, this would allow you to reconfigure the CradlePoint so that Ethernet ports 1 & 2 will belong to the Primary LAN while Ethernet ports 3 & 4 will belong to the Guest LAN. To do this, you would need to create a separate Port Group within the Ethernet Port Configuration tab found under Local Network Interfaces. You may have to first unassign those ports from the Primary LAN before reassigning them to other LANs.

To assign the Guest LAN to the “Hotspot Service” for CradlePoint routers that support the Hotspot Service feature, change the Guest LAN’s “Routing Mode:” from “NAT (default)” to “Hotspot”.

Share Article: