What a Guest Network Actually Separates

A guest network separates devices from each other. It does not separate them from anything upstream. Visitors on the guest side still leave under the same public address, still get handed the same resolvers, and are still just as visible to whoever operates the line as anyone on the main network — because the router is the same router and the connection is the same connection. What changes is who can reach whom inside the house.

That is a genuinely useful thing to change, and it is worth being precise about, because two quite different features are sold under the same label and consumer routers rarely tell you which one you have.

Two different features, one name

The first is a separate network segment. The guest name gets its own address range, its own gateway address, and its own set of firewall rules. A device on it cannot address a device on the main network at all, because the addresses it would need to use are not on its network and the router declines to pass traffic between the two.

The second is client isolation on a shared segment. Everyone is on the same address range with the same gateway, and the router simply refuses to forward traffic from one client to another. Devices cannot reach each other, but they are neighbours rather than strangers, and the separation depends on the router continuing to enforce a rule rather than on the addressing making it impossible.

Both are reasonable. The first is stronger, because it removes the broadcast and discovery chatter as well as the direct reachability — a device on its own segment never even hears the announcements described in what your device announces to a network. Many routers offer both, sometimes as one checkbox, sometimes as two, and sometimes labelled identically.

Telling which one you have

You do not have to read the manual. Join the guest network from a phone or laptop and compare four values against the same values on the main network, using the platform commands in how to read your own network settings:

The address. A different leading portion means a different range, which means a separate segment.
The gateway. A different gateway address is the clearest single indicator of a separate segment. The same gateway means you are on the same network with rules applied.
The mask. A narrower mask on the guest side is common and tells you how much room the guest range has.
The resolvers. Usually identical to the main network’s, which is itself informative — see below.

Then try to reach something. Ask for a known main-network device by address, not by name, so a resolution failure cannot be mistaken for isolation. No answer from either kind of guest network is the expected result. An answer means the feature is not doing what its name implies, and that is worth knowing before you rely on it.

What separation actually buys

It contains devices, not connections. Three cases where that is exactly the right tool:

Hardware you cannot configure. A smart appliance, a television, a camera, a plug: things with no settings page worth the name, software you do not choose, and update behaviour you cannot inspect. Putting them where they can talk to the internet and to nothing of yours is the only real control you have over them.

Visitors. Handing someone the main password gives their laptop reachability to your file shares, your backup target, and your router’s admin page. Most people who ask for the Wi-Fi are not a threat; the point is that you no longer have to make that assessment.

Anything that broadcasts. On a separate segment your own devices stop advertising their services to visitors’ devices, and visitors’ devices stop advertising to yours. That is a mutual reduction in noise as much as a security measure.

What it does not touch

Everything past the router is shared, and “guest” says nothing about it.

The public address. Both networks leave under the same one, so anything attributed to that address covers guests and household equally, including whatever reputation the address has accumulated. A guest who attracts a rate limit or a block attracts it for the whole line.
The destinations. Whoever can see the line’s traffic sees traffic from both networks alike, undifferentiated except by whatever the router chooses to log.
The resolver. The router advertises resolvers to guests too, usually the same ones, so every hostname a visitor looks up goes to the same place yours do — which is a decision you made on their behalf, per who runs your DNS resolver.
Bandwidth. Unless the router has a separate limit for the guest range, guests compete with you for the same line.
Your visibility to guests as a network operator. Isolating them from your devices does not isolate them from you. Traffic on a guest network passes through hardware you administer.

The last one is worth saying plainly to anyone joining a guest network anywhere: the label describes what you cannot reach, not what cannot see you.

The router-tunnel interaction people get wrong

If you run a tunnel on the router, whether it covers the guest network is a configuration detail with two opposite failure modes, and both are silent.

A router-level tunnel applies to a routing and firewall zone. If the guest zone is outside that zone, guest traffic goes out directly while the main network is tunnelled — and the router’s status page will still show the tunnel as connected, because it is. If the guest zone is inside it, every visitor’s traffic is routed through a provider they never agreed to, presented under an exit address they did not choose, and resolved by a resolver you selected for them.

Neither is discoverable from the router’s own interface. It has to be checked from a device attached to the guest network, by comparing the apparent public address there against the one on the main network and against the one with no tunnel at all. This is the same class of trap as the other router-edge surprises in putting the VPN on your router: the device doing the work reports on itself accurately and tells you nothing about what the devices behind it experience.

What to check once, and then leave alone

Whether the guest network is a separate segment or an isolated shared one, by reading the gateway.
Whether isolation actually blocks device-to-device traffic, by trying it by address.
Whether the guest range gets the resolvers you intended.
Whether a router-level tunnel includes it, from the guest side.
Whether the guest password is different from the main one, which is the entire point and is easy to get wrong when a router’s setup wizard offers to copy it.

Answer those five once and a guest network becomes what it should be: a durable boundary inside your house that needs no maintenance, sitting alongside — not instead of — whatever you have decided about the path out of it.