Build a UniFi network for a cafe or retail shop

Goal and requirements

Build separate business networks while keeping payment and printing usable. You need a UniFi gateway, managed switch, APs, a wired administrator laptop and a maintenance window. Obtain the payment and point-of-sale providers' connectivity requirements: wired or wireless connections, WiFi security, local discovery, fixed addresses and outbound services.

Keep a provider-approved way to continue trading or revert. This example does not establish payment compliance.

Plan the network

Network VLAN Subnet Purpose
Main10 10 192.168.10.0/24 Staff computers
IoT20 20 192.168.20.0/24 Non-payment smart devices
Guest30 30 192.168.30.0/24 Customers
Cameras40 40 192.168.40.0/24 Cameras and separate NVR
POS50 50 192.168.50.0/24 Approved payment and POS devices
Printers60 60 192.168.60.0/24 Printers that support routed access

Use .1 gateways and .100 to .199 DHCP pools. Keep infrastructure management unchanged. A printer that requires same-subnet discovery may need to stay with its POS system instead of using Printers60. Confirm that requirement with its supplier.

Configure in a controlled sequence

  1. Record the existing workflow. Note terminal and printer addresses, cables, SSIDs and application settings. Perform a provider-approved test transaction and receipt print before changing anything. Save the router configuration and label a known-working management port. This establishes whether a later fault is new.
  2. Create the networks and assignments. Add the table's networks in Settings › Networks. Put wired terminals on POS50 access ports and cameras plus the separate recorder on Cameras40 access ports. Create Staff, Business POS and Guest SSIDs only where wireless clients need them. Carry the required VLAN tags through AP uplinks. Limit guest-facing wired sockets to Guest30.
  3. Stabilise important addresses. Use DHCP reservations for printers and any terminal identified by an IP-based rule. Record MAC address, reserved address and purpose. DHCP supplies addressing, default gateway and DNS information; a fixed address must still use the correct gateway and DNS for its subnet. [1]
  4. Define firewall scope. Place the functional networks in clearly named firewall zones, or use network-specific matches within the existing zones. In the zone policy editor, select the actual source and destination networks for each rule. Preserve established return traffic, create required allow rules first and position broader blocks afterwards. The editor can match addresses, ports, protocols and IP version. [2]
  5. Apply the example policy. Permit Guest30 to internet services and the gateway's necessary DHCP/DNS services, while blocking guest access to other local networks and gateway administration. Block POS50 from staff, cameras, IoT and management networks. Allow its provider-required internet services. Permit a POS-to-printer connection only where documented. For an explicitly assumed receipt printer supporting raw TCP printing, this might be POS50 to one reserved printer address on TCP 9100, with return traffic allowed. Replace that example with the supplier's actual protocol.
  6. Limit printer reachability. Allow staff to the specific business printer using its documented protocol, such as IPP on TCP 631 where supported. Avoid permitting all of Main10 to every device in Printers60. Block printer-initiated connections into unrelated local networks. If discovery fails but direct-IP printing works, document the direct configuration or implement only the necessary discovery service.
  7. Configure guest behaviour. Enable guest client isolation and supported switch-level isolation. For an optional captive portal, open Settings › WiFi › Guest, enable Hotspot Portal and configure the landing page under Insights › Hotspot. Vouchers are one supported authentication option. Permit Guest30 to reach the actual portal host on the services required by that host and software version, placing these exceptions above the broader guest-to-Gateway or local-network blocks. Use the Required Ports Reference to identify the applicable ports. Test a fresh, unauthenticated client: the landing page and sign-in must work while gateway administration and private devices remain inaccessible. [2] [3] [5]
  8. Apply a modest guest limit. Create a WiFi Speed Limit profile and attach it to Guest. Choose initial upload and download limits from the measured internet service, then test while staff and POS workflows run. A per-client limit does not reserve a fixed total share for the business. Use the gateway's supported QoS controls if aggregate traffic policy is needed. [4]

Acceptance and recovery

Test browsing and DNS from every network that needs internet access. Complete the provider-approved payment, receipt, reprint and end-of-day workflows. Verify staff printing, camera playback and guest isolation using known application services. Test guest devices on different APs and any public Ethernet ports. If IPv6 is deployed, repeat the same separation tests over IPv6 rather than accepting IPv4 results alone.

For a fault, first identify whether the client lacks an address, cannot resolve a name or cannot reach a required service. Inspect the relevant firewall match and add a narrowly documented exception when justified. Do not make payment terminals generally reachable from guest devices to fix discovery.

If trading is affected, restore the recorded port or SSID assignment and its previous network configuration, then repeat the original provider-approved test. Keep a final network table, rule list, printer instructions and a dated record of the successful operational tests for the person who supports the site.

Sources

Back to the series

Leave a comment

Please note, comments need to be approved before they are published.