What it means
A different network name or password does not automatically create a security boundary. Supported guest modes may block private-LAN access, isolate clients or apply a time limit. Behaviour can differ across mesh nodes and wired ports. Local discovery features may stop working when isolation is enabled.
How this affects everyday use
An enabled intranet option, an unsupported mesh mode or a misplaced wired connection can give guests more access than intended. Excessive restrictions can also prevent a legitimate casting or printing task.
A practical example
A visitor should browse the web but should not reach the family's storage server.
What to check
- Test internet access from a guest device.
- Attempt access to a known private resource using an authorised test.
- Check isolation behaviour on each relevant mesh node.
Practical next steps
- Enable supported private-network isolation.
- Give guests a distinct strong password and revoke access when appropriate.
- Allow only specific justified exceptions for shared services.
Keeping it reliable
Recheck after firmware or mode changes. Keep owner administration off the guest network. Explain any limitations without promising that a separate SSID alone protects every private device.