The guest-wifi gotcha: client isolation, explained
Here is the support ticket we'd receive most often if we had support tickets. Two devices, same room, same wifi network name, both with full signal. The QR labels swap perfectly — scan, reply, scan. And then… nothing. The connecting spinner runs out its clock and the counter apologises. The user, reasonably, concludes the tool is broken. The tool, for once, is innocent: the network they're standing on was built to make this fail.
A bouncer between every pair of guests
The feature goes by several names — client isolation, AP isolation, station isolation, "guest mode" — and it does one simple thing: the access point refuses to forward traffic from one wireless client to another. Every device can reach the router and the internet beyond it; no device can reach its neighbours. For a coffee shop, a hotel or a corporate guest VLAN this is genuinely good security. Strangers' laptops shouldn't be able to poke at your phone just because you both ordered espresso. The bouncer is doing honest work.
The trouble is that the bouncer is invisible. Nothing in your wifi settings says "isolated". Signal is perfect, browsing is perfect, even a video call works flawlessly — because a video call relays through servers on the internet, using exactly the up-and-over path that isolation permits. The only thing that breaks is the one thing this counter is proudest of: the direct, room-crossing path.
The symptom pattern, so you can diagnose in a minute
- Pairing labels swap fine, connection never opens. The QR exchange happens by camera, so isolation can't touch it. The failure arrives after — during the probe phase, when the devices first try to reach each other's addresses and every probe dies at the access point. Our counter watches for that timeout and names the suspect out loud.
- Everything internet-based works. That's the tell that distinguishes isolation from a wifi problem. Bad wifi breaks browsing too; isolation breaks only neighbour-to-neighbour traffic.
- The network is one you don't own. Hotels and cafés isolate almost universally; offices isolate their guest VLANs; some home mesh systems quietly isolate their guest SSID by default too. On your own main home network, isolation is rare unless someone switched it on.
Three ways past the bouncer
One: use the main network, not the guest one. At home this solves it outright — the guest SSID's whole personality is isolation; the main SSID almost never has it. Check which name each device actually joined; phones love to cling to the wrong one.
Two: make your own wifi with a hotspot. The elegant road-warrior fix. Turn on the personal hotspot of one phone, join the other device to it, and load the counter on both. A hotspot is a tiny router you own, with no isolation, and the transfer never uses the hotel's network — or your mobile data, since the bytes go device-to-device inside the hotspot. (Beaming to the hotspot phone itself works too.)
Three: for genuinely separate networks, the marked switch. If the two devices simply aren't on one LAN — you're beaming to a friend across town — local paths can't exist. Our different-networks switch asks a public STUN server for each device's outside address and tries the long way round. It's off by default because it discloses your IP to that server, and we'd rather say so than pretend; even then, your files travel directly, not through it.
One caveat for completeness: a minority of strict networks (some corporate ones) block even STUN-assisted paths, and getting through those takes a relay server — which we deliberately don't run, because a relay would see your traffic and we'd rather fail honestly than succeed creepily. The percentage is small; the hotspot trick covers nearly everyone it affects.
So: full bars, happy browsing, no beam? You now know the bouncer by name. Move to the main network or raise a hotspot, then come back to the counter — and if you want to see what the wifi between your devices can really carry once they can talk, put it on the scales.