Network › Module 10 › Lesson 2
Guest SSIDs and IoT Isolation
Guests and lightbulbs should not sit on the same LAN as your laptop — checklist, not a rogue AP.
Visual · guest_ssid_iot_isolation
Isolate guests and IoT on APs YOU own. Never aircrack.
Opening
A smart bulb does not need a path to your tax folder. A guest phone does not need your NAS.
Home networks fail in a flat, friendly way: one SSID, one passphrase, printers and laptops and cameras in a single broadcast domain. Guest SSIDs and IoT/VLAN isolation are how people who own the AP shrink that blast radius. This lesson is a checklist for gear YOU administer. It is not “stand up a fake AP,” not “deauth the neighbors,” not “scan the guest net for cameras to prove the point.” Original Cyberlium.
1. Three buckets: you, guests, things
You: laptops and phones that hold work and money. Guests: people who need the internet until they leave. Things: cameras, bulbs, TVs, vacuums that phone home and rarely need to see your files. Mixing all three is how a cheap camera becomes a pivot in a crime report.
Isolation is a policy: guest cannot initiate to private; IoT cannot initiate to private; private may reach the internet. Vendor menus call this guest network, AP/client isolation, or VLANs. You still only toggle them on APs you own after GATE.
2. Profile names, not secrets
Windows can list saved WLAN profile names with netsh wlan show profiles. That is a memory of SSIDs THIS user saved. It is not a password dump. Do not add key=clear. Do not publish the list if it contains workplace SSID names you should not share.
Linux nmcli connection show is similar. Redact. You are proving you know isolation is about who shares a Layer-2, not proving you can extract PSKs.
Command guide
Profile names, not secrets
═══ COMMANDS ═══
Command — copy this
netsh wlan show profiles || powershell.exe -NoProfile -Command "netsh wlan show profiles" nmcli -t -f NAME,TYPE,DEVICE connection show
3. What isolation is not
It is not deauthing neighbors so they join your honeypot. It is not nmap of 192.168.0.0/24 to “find IoT.” It is not hydra on the camera's default password across the LAN as a class exercise (changing a default on a camera you own, from a browser you already use, is a different, careful maintenance task — not a sweep).
Zero Trust in the next lesson will say even a “private” SSID is not a soul. Isolation still helps because malware and guests are not souls either.
4. What you ship: a three-bucket isolation checklist
CSV: you / guest / IoT. Profile names without keys. No rogue AP. No /24 IoT hunt. DEMO GATE holds. Apply AP toggles only on gear you own when GATE allows.
5. What you record before the next lesson
t11-m10-buckets.csv. DEMO identified/STOP. SAFE NEVER aircrack/deauth/nmap-for-cameras. Next: Zero Trust.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Fake a guest SSID with the café's name. deauth clients. nmap the IoT subnet. key=clear to Slack.
Right
Write three buckets. List SSIDs you already saved, without secrets. Next: Zero Trust Never Trust the Network.
Mission: separate you, guests, and things on paper
1) / STOP if router. 2) Fill the three-bucket CSV. 3) netsh wlan show profiles or nmcli connections (names only). Never dump keys. Never scan for cameras. Never aircrack.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor what client isolation means on a home AP you own — not how to deauth a neighbor.
Knowledge Check
APPLY: A visitor needs internet at your place. Best Cyberlium default?
Multiple choice
Knowledge Check
APPLY: True or False: netsh wlan show profile name=Home key=clear is the required lab command.
True or False
Knowledge Check
APPLY: IoT on the same LAN as your laptop means:
Multiple choice