Guest House With Three Floors of Complaints

Diagnosis

• Same-name extenders create sticky clients. A device associates with the first access point it hears and holds on until the signal is almost unusable, so a guest walking along a corridor stays attached to a distant extender. The device does not decide to roam; the network must encourage it.
• Extenders halve throughput. A repeater receives and retransmits on the same radio, so every hop costs roughly half the available airtime. Two hops of a weak signal give a connection that is present but unusable - matching the 'signal shows, pages time out' symptom.
• Placement amplifies a bad signal. Extenders were put on landings where the router's signal was already marginal, so they rebroadcast noise.
• Co-channel interference and capacity. One consumer router with 60 associations, plus three repeaters, competes for the same channels in a dense concrete building; 5 GHz is attenuated heavily by the floors, so most clients fall back to crowded 2.4 GHz.
• DHCP scope. A consumer router's address pool may be too small for 60 devices, causing intermittent failures to obtain an address.

Design within EC$6,000

Run Cat6 cable from a small PoE switch to one ceiling access point per floor, positioned over the corridor so rooms are served through one wall rather than through a slab. Use business APs with a controller (or cloud-managed) so they share one SSID with proper handover, enable band steering, set 2.4 GHz to channels 1, 6 and 11 with reduced power so cells overlap only slightly, keep 5 GHz at higher power for in-room speed, and size the DHCP scope for at least 100 leases. Cabling labour is the main cost; three APs and an 8-port PoE switch fit the budget more reliably than another pile of extenders.

• Replace the open network with WPA2/WPA3 and a captive portal. An open SSID lets anyone in the car park join, consumes bandwidth and provides an anonymity shield for abuse. A shared guest passphrase, rotated weekly or issued at check-in, plus a portal page with terms makes users identifiable to a room and creates a record of acceptance of the acceptable-use policy.
• Separate guest, staff and POS traffic with VLANs and access-control rules. The front desk tablet and any property-management system must not be reachable from a guest device; a compromised guest laptop should not be able to scan or attack reception.
• Enable client isolation on the guest SSID. Guests should not see each other's devices, which blocks casual snooping and lateral movement between infected machines.
• Apply per-client rate limiting and content filtering. This stops one guest monopolising the 20 Mbps line and gives a documented response to complaints about illegal activity.
• Keep logs of associations and DHCP leases for a defined retention period. When a rights-holder complains, the guest house can map an IP address and timestamp to a room; without logs it can neither respond nor defend itself. Note the data-protection duty to keep only what is needed and to say so in the policy.
• Harden the equipment: change default admin passwords, disable WPS and remote administration, and keep firmware updated, because consumer routers with default credentials are routinely recruited into botnets.
• Publish an acceptable-use policy at check-in, so consequences such as disconnection are contractually clear.

Peak season means disruption tolerance is the binding constraint, so order the work by risk and by dependency, not by visibility.

1. Survey and plan first, off-season for cabling decisions. Walk the building with a signal survey to confirm AP positions and cable routes; this costs nothing and prevents buying the wrong hardware.
2. Fix the existing router settings now, in one short window. Change admin credentials, set a DHCP scope of at least 100 addresses, schedule a nightly reboot, and give staff their own SSID. These are minutes of downtime and remove several causes of the front-desk dropouts immediately.
3. Remove the extenders when the first access point goes live, not before. Removing them early would leave the top floor with nothing.
4. Cable and install one floor at a time, starting with the top floor. Rooms 12–18 generate the most complaints, so the first cut visibly improves the worst case and builds confidence. Work on one floor per morning, with service restored by check-in time.
5. Introduce the captive portal and VLAN separation after the wireless is stable. Security changes cause the most support calls from guests, so do them when the underlying link is no longer being blamed for every problem.
6. Run both configurations for a week and keep the old router as a cold spare. Compare complaint counts before removing it completely.

Justification: each stage is independently useful, reversible within a day, and the riskiest change (security policy) lands last, when the physical network is proven.