Home > PCI compliance > Card terminal network separation
Card terminal network separation: keep payments off guest Wi-Fi
In many small businesses the card terminal, the office computers, the cameras and the free customer Wi-Fi all run on one network. If any one of them is compromised, the rest are exposed. Putting payments on their own protected lane is one of the simplest ways to cut risk and make PCI compliance easier.
The short answer
- Network separation (also called segmentation) puts card terminals and point of sale systems on their own network that guests and other devices cannot reach.
- PCI DSS treats everything that can talk to card systems as "in scope." Separation shrinks that scope, which means fewer systems to secure, scan and document.
- It is done with a business firewall and properly set up VLANs, not by just giving the guest Wi-Fi a different password.
- Many processors and cyber insurers now ask whether guest Wi-Fi is separated from payments.
Why one shared network is a problem
On a flat network, every device can see every other device. A customer's infected phone on your free Wi-Fi, an old security camera, or an employee clicking a bad email link can become a path to the computer or register that handles cards. Attackers who break into small businesses often start with the weakest device and move sideways until they find payment data.
What good separation looks like
- A business firewall sits between every lane and decides exactly what may pass.
- Separate VLANs on switches and access points, so each lane really is its own network.
- Payment traffic allowed only to the processor, not to the open internet or the office.
- Guest Wi-Fi isolated, with client isolation turned on and filtering for families. See family friendly guest Wi-Fi.
- No shared passwords between lanes, and admin access locked down.
- Written diagram and notes, because your PCI questionnaire and insurer will ask.
- A yearly test that confirms one lane really cannot reach another.
Common setups we fix
| What we find | Risk | What we do |
|---|---|---|
| Guest Wi-Fi on the same network as the register | Any guest device can reach payments | Move guests to an isolated lane |
| Internet provider router doing everything | Limited controls, often outdated | Add a business firewall behind it |
| Consumer mesh Wi-Fi with one network name | No real separation | Business access points with separate VLANs |
| Cameras open to the internet | Common entry point for attackers | Device lane, remote viewing through a secure app or VPN |
| No diagram or records | Hard to answer PCI and insurance questions | Network diagram and settings documented for you |
Does every terminal need this?
Not always. Standalone terminals that run on their own cellular connection never touch your network. Terminals and POS systems that use your office internet, which is most of them today, are the ones that benefit. If you are not sure how yours connect, we check for you and tell you plainly whether a change is worth it.
How WENO separates your payment network
Questions people ask
Is a separate guest password enough?
No. A different password on the same network still lets devices see each other. Real separation needs separate networks controlled by a firewall.
Will this slow down my card terminals?
No. Payment traffic is small. A properly set up firewall usually makes the payment lane more reliable because guests cannot use up its bandwidth.
Does separation make me PCI compliant?
It is one important part. It reduces what is in scope, but you still complete your questionnaire and any required scans. See failed PCI scan fixes.
Can you work with my POS company?
Yes. We coordinate with your POS or processor support so terminals keep working after the change.
Sources
- PCI Security Standards Council: PCI DSS and scoping and segmentation guidance
- CISA: cybersecurity best practices
General information, not legal advice. Your processor sets the exact requirements for your account.