Blog / 8 July 2026
Segmenting a hotel network: guests, PMS, POS and cameras
Hospitality networks carry traffic with very different risk profiles over the same cabling. Segmentation is what keeps a compromised guest device away from payment and booking systems.
The VLAN layout
- Guest — internet only, client isolation on, bandwidth shaped per room.
- PMS and back office — reachable only from named staff subnets.
- POS — isolated and logged, with outbound rules to the payment gateway only.
- Surveillance — cameras and recorder on their own VLAN, no internet route.
- Building services — door locks, BMS, lifts.
Where it usually breaks
Two places: an engineer plugging a laptop into a camera port during maintenance, and a supplier installing a device with a default password on the wrong VLAN. Port-level access control and a written change process fix both.
We build this layout as a standard branch template so every property in a group looks the same to the support team.