Most guest WiFi projects don't fail on the WiFi. They fail on the network around it.
When one gateway serves dozens or hundreds of access points, a small hotspot setup stops being enough. Your IT team asks for central RADIUS, proper accounting and an audit trail. And RADIUS done carelessly is one of the easiest things to attack.
So we wrote down how we do it.
ISN Free WiFi now offers an enterprise secured RADIUS service, on request. We host it, we secure it, and we agree with you exactly what your network must do before a single guest connects.
What the guide covers:
A private path. Plain RADIUS never crosses a network we don't control. RadSec with mutual certificates, or an IPsec or WireGuard tunnel, plus strict IP allow-lists at two firewalls.
Layers, not hope. Unique long secrets per gateway, Message-Authenticator on every packet (the fix for the 2024 Blast-RADIUS attack), single-use guest logins, isolated and hardened servers, and tamper-resistant logs.
A clear list for the ISP. The addresses, certificates, firewall rules, accounting settings and site hardening we need from you, so go-live is not a surprise.
Honest about who it is for. It is built for large projects. For a single venue or a few routers, we do not recommend it. A simpler setup is more reliable and has less to attack, and the guide says so.
If your project needs central RADIUS, or your security team has questions about how the hosted service is protected, read the full guide:
Planning a municipal, campus, estate or large ISP rollout? Message me and let's talk.