Notes
Your guests are on the same network as your till
One flat network for the till, the NAS and the bloke uploading wedding photos. The fix is a checkbox most people have switched the wrong way, plus twenty minutes.
A woman I know runs a café up on Johnston Street. Last winter her card terminal started dropping out for a minute or two at a time, always between eleven and two, never at night. She replaced the terminal. Same thing. Then she blamed the NBN and spent forty minutes on hold to be told the line was fine.
It was a bloke in the window seat syncing a folder of wedding photos to Dropbox over the café wi-fi. Every lunchtime, for a fortnight. Tens of gigabytes of upload on a 50/20 service, and every card authorisation queued politely behind it.
That is the small version. The large version is that her terminal, her laptop, the camera recorder and a NAS with eight years of invoices on it all sat on one flat network with whoever happened to be drinking a long black.
One network, one blast radius
The mistake is not that you offer wi-fi. It is that the wi-fi you offer is the same network your business runs on, and every device on a network can reach every other device on it. That is not a flaw in the design. That is the design.
People imagine the danger is someone reading their email out of the air. It isn’t. TLS handles that. The danger is reachability. A phone with something nasty on it joins your network and knocks on every address in the range to see what answers. What answers, in most small businesses I look at, is a NAS with file sharing on and no password worth the name, a camera recorder still on admin/admin, and a router whose administrator password is printed on a sticker underneath it.
I spent fourteen years in IT before this, the last stretch as infrastructure manager for a freight company in Laverton. A contractor plugged a laptop into the warehouse network to set up some forklift scanners, and whatever was on it spent the next hour scanning the address range. By five the label printers in dispatch were producing nonsense and the weighbridge PC, unpatched since about 2014, had stopped being a weighbridge PC. I was there until two in the morning. Nobody targeted us. We were reachable, and that was enough.
The terminal is the least of it: card data is encrypted to the acquirer before it leaves the device. What hurts is the laptop signed into Xero and the business banking, and the drive holding the invoices and customer records you are required to keep for five years — seven if they are company or employee records.
What a guest network actually is
A guest network is a second wi-fi name that goes to the internet and nowhere else. Traffic on it can reach Instagram and cannot reach your NAS. The proper term is a VLAN, which sounds like something you hire a consultant for and on consumer gear is a checkbox.
On a TP-Link Deco, an eero, a Google Nest or most ISP-supplied modems it lives under Guest Network. Turn it on, name it something obvious, then find the setting worded something like “allow guests to access my local network” and make sure it is off. That toggle is the whole job. If there is a client isolation option, switch that on as well, so guests cannot see each other either. On Omada or UniFi gear you create a network, tick the box marked Guest, and attach a wi-fi name to it.
Then move everything that is yours onto the main network. If your gear has room for a third, put the cameras and the printer on it; they run software nobody has updated since the factory.
Do not trust the label. I have seen modems where the guest network was guest in name only, and a phone on it could open the printer’s configuration page. Test it yourself:
- Join the guest network, then type 192.168.0.1, 192.168.1.1 and the address of your NAS into a browser. Nothing should load.
- Try to AirPrint, or cast to the speaker behind the counter. It should find no devices at all.
- Check which network the card terminal and the office laptop are actually joined to. Staff reconnect things to whichever name has the shorter password.
- Start a large download on the guest network and, while it runs, put a $1 test transaction through the terminal.
Bandwidth, and why the tap fails
A card authorisation is a few kilobytes. It does not need speed, it needs an answer inside a couple of seconds, and on a congested line it does not get one. What breaks small businesses is upload. A 50/20 service has 20 Mbps going the other way, one person’s cloud backup takes all of it, and the terminal sits several seconds deep in a queue while the customer holds a phone against a screen that says Processing.
Two settings fix it. Cap the guest network per device: 5 Mbps down and 1 Mbps up covers browsing, email and a video call, and anybody who needs more than that in a café is doing something you should not be funding. Then switch on smart queue management or QoS if your gear has it. It exists for precisely this.
The password on the docket, and the log you do not want
Password the wi-fi. Not for security — a password four hundred people know is not security — but because an open network invites the whole street, and because it gives you a small lever. Ours is printed at the bottom of every docket and changes on the first of the month. If you want to keep working past one o’clock, you buy something. It did not transform the takings. It did stop three people a day asking at the counter.
What I would not do is put in a captive portal that demands an email address first. You are then holding a list of customer addresses in a system you did not build and do not watch, for a mailing list nobody opens. A business turning over $3 million or less generally sits outside the Privacy Act, which is the argument people use for collecting whatever they like. The exemption falls away for anyone trading in personal information, and in any case it removes the obligations, not the consequences.
Same goes for logging. Do not install anything that records what people browse. The router keeps a short rolling list of which devices connected and when, it overwrites itself, and that is all I want to exist. Nobody official has ever asked me about our wi-fi. The one person who did ask wanted to know why Instagram was slow. He was right, and that is how I found the queue management setting.
Ten dollars a month, and a Tuesday afternoon test
The best money a café spends on technology is mobile failover. A backup connection sits idle behind the NBN service and takes over within seconds when the line drops, so the till keeps working and nobody writes a sign about the ATM up the road.
Aussie Broadband sells it as an add-on: $10 a month on their business 25/10, 50/20 and 100/20 plans, free on the faster ones, using a Netcomm NL19MESH that starts at $240 plus postage. It is built to run at 25/5, ample for a card terminal, a kitchen printer and one laptop. Other providers sell the same thing under other names.
Put that against a lost Saturday. At Zeller’s 1.4 per cent, a $2,000 card day costs you $28 in fees; on Square’s 1.6 per cent it is $32. Lose half those takings because the line is down, and the thousand dollars you did not ring up would have paid for eight years of the failover add-on.
One catch, and everybody finds it the hard way: failover does nothing in a blackout, because the modem is not running either. A small UPS under the counter, enough to hold the modem and the terminal for half an hour, is the other hundred dollars worth spending. Then test it properly. Pull the NBN cable out at three o’clock on a Tuesday and watch what the card machine does. Better then than on a Saturday with eleven people in the queue.