How to create a secure public/guest wifi?

[Nameless]

Hey folks, sorry if this is the wrong section of the forums for this post but i was unsure where to ask this.

Here is the situation, im no good with networks or security but i am being asked a dozen questions about securing a public/guest network. Also im a little out of touch with some terms you may use these days and yes im not the brightest crayon in the box at times haha.

Right here is what i know, the network is using an AP made by Unifi, basically anyone can walk into the business and log onto "businessname wifi" so im guessing this means that it is unencrypted?

What im wondering is if a login page or password was required then would this stop/make it harder for someone to use hacking apps on the network and spy on customers? I would name the app i believe they are using on their mobile but im unsure if that would be against the rules etc but it seems to be able to wardive, MITM attacks and a few other things. Also would this help with apps such as wireshark? (they sometimes have their laptop)

Any help, guidence or links to posts about how to prevent this would be appreciated. I do not mind doing homework in my spare time.

 

[Wave]

Also would this help with apps such as wireshark?

Encrypt the traffic via VPN and use HTTPS.

 

[Neno]

Well that is a broad theme.
There are lots of ways to secure your WiFi networks or networks in general.
To answer your question would take a lot of time and a lot of info from your side. To encrypt the traffic via VPN as suggest above is just a small part of it all.
But the first station would be your WiFi router settings (WPA2/Enterprise/AES... etc), than possible subnetting, do you use servers and which ones (Windows ... etc)... network location/profile settings ... myriads of things.
Starting point - router (and subnet's).
(If you talk about Wireshark or Microsoft Message Analyzer than you might know a thing or two about networking ).

 

[Wave]

To encrypt the traffic via VPN as suggest above is just a small part of it all.

I wasn't referring to securing the network like you are talking about, I quoted a specific part regarding Wireshark prior to commenting about encrypting the network traffic and using HTTPS websites for logging in. If you check above you'll see this.

HTTPS encryption will stop people who are sniffing the network from obtaining the unencrypted credentials being entered into websites, and VPN encryption is another layer of encryption prior to the HTTPS encryption to prevent people from seeing what websites you are accessing, etc.

 

[Rolo]

A public WiFi should isolate all clients, no client on the guest network should be able to see any other client.

Lock Down Your Wi-Fi Network With Your Router’s Wireless Isolation Option

 

[LukeNukesEm]

Use a paid VPN that uses strong encryption (AES 256, RSA 4096 handsake). I recommend NordVPN. Also be sure to use HTTPS as much as you can, there are extensions for this such as https everywhere. Hope I helped!

 

[Nameless]

First off thanks for the responses i will read though everything again a little later im rushing about this weekend because i have a lot to do and not enough time to do it in.

As for VPN i personally use one myself at home, though getting it to work on my mobile is proving to be a pain even with their own app and i have not had time to sort it out. (random passwords are a pain sometimes) but anyway back on topic...

The network im talking about is a public network that has already been setup for customers to use via a unifi access point, the best way for me to describle it is like a starbucks one. You walk in and "ooh free wifi!" but like i said no password or login page is displayed this is to make it easier for the customer to connect because not everyone is techminded but like i said i also think its less secure for them as their may not be any encryption running making it easier for someone to gather personal information (ive not seen the access points security options etc).

I already know that using https is a must and like i said i use a VPN at home daily, but if i got a VPN working on my mobile that is only protecting myself and not others from a bad users activity which i would like to try and do even though i know this user will continue to try and spy on other peoples activity.

I will look into the network isolation suggested by Rolo and see if the router or access point can do this.

As for subnetting, i have no idea what that really is Neno i need to read up about it when i can, all i know is that the router is set upto give two networks Private one for business use and a Guest one for customers which is shared to them via this Unifi accesspoint.

The whole network has been setup by someone else im more of a plug and play type of guy and only mess with settings when i need to. The network in question at the moment is a friends they want to make it more secure for customers as they feel someone is using applications they should not be.