Restaurant POS Network Segmentation Checklist, How to separate POS, guest Wi-Fi, and office devices on one internet line

One internet line can run your whole restaurant, or it can turn into one big shared hallway where anything can bump into anything. That’s why I treat POS network segmentation like putting solid doors between your dining room, your office, and the cash drawer.

When POS, guest Wi‑Fi, and office devices share the same network, you don’t just risk slow service. You risk card data exposure, malware spreading sideways, and support calls that never end. The good news is you can separate these systems cleanly with VLANs, smart Wi‑Fi SSIDs, and a default-deny firewall policy.

What “POS network segmentation” really means (and how it helps PCI scope)

In plain terms, POS network segmentation means I split one physical internet connection into multiple logical networks. Each network gets its own IP range, its own Wi‑Fi SSID (if wireless), and its own set of firewall rules. Devices inside one segment can’t casually talk to devices in another segment.

PCI DSS cares about this because the POS environment is often part of the cardholder data environment (CDE), or at least adjacent to it. The more your POS touches, the larger your PCI scope becomes. Segmentation helps keep that scope tight by isolating payment traffic from everything else. If you want the official language, I point people to the PCI SSC definition of network segmentation and the deeper PCI scoping and segmentation guidance PDF.

My baseline rule is simple: default-deny between VLANs. Then I add only the few “doors” the restaurant actually needs to operate.

Step 1: Build a VLAN and SSID plan you can copy

I start with a plan that matches how a restaurant works. Guests should only reach the internet. Office devices should reach business apps and printers, but not every POS device. POS should be the most restricted, even outbound.

Here’s a practical sample you can implement on most business firewalls, managed switches, and business access points:

VLAN	Zone name	Subnet	DHCP range	Typical devices	Wi‑Fi SSID
10	POS (PCI scope)	192.168.10.0/24	.100 to .200	POS terminals, payment devices, POS printers	POS-Staff (hidden or staff-only)
20	Guest Wi‑Fi	192.168.20.0/24	.100 to .250	Customer phones and laptops	Restaurant-Guest
30	Office / Back office	192.168.30.0/24	.100 to .200	Manager PC, bookkeeping, inventory tablet	Restaurant-Office
40 (optional)	Kitchen / IoT	192.168.40.0/24	.100 to .200	KDS, kitchen tablets, cameras	Kitchen-Devices (optional)

Implementation notes I stick to:

• The firewall/router does the VLAN routing and DHCP, not the switch.
• The switch uplink to the firewall is an 802.1Q trunk carrying VLANs 10/20/30 (and 40 if used).
• Each wired port is an access port in exactly one VLAN. No “everything ports.”
• POS Wi‑Fi uses WPA3 (or WPA2-AES if needed) with a unique passphrase, not shared with guests, and not written on the wall.

If you run Toast, Square, or another POS, always align outbound needs to vendor requirements. For example, Toast publishes a useful reference in the Toast Network Requirements 2023 PDF that can help you tighten POS egress rules.

Step 2: Set default-deny firewall rules (with least-privilege exceptions)

Think of your firewall like a host stand. It decides who goes where, and it should say “no” by default.

Plain-English rules I use most often:

1. Guest VLAN to internet only. Block access to all private RFC1918 networks (192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12).
2. POS VLAN to internet is allowed only for what it must reach (payment processors, POS cloud endpoints, DNS, NTP). Block the rest.
3. Office VLAN can reach internet and approved cloud apps, and it can reach POS only for defined support needs.
4. Block inbound from the internet to any internal VLAN. No port forwards for POS, printers, or “remote desktop.”

A compact pseudo-rule table (adapt to your firewall terms):

From	To	Allow	Deny
Guest (20)	Internet	TCP 80/443, DNS	Any LAN subnets
Guest (20)	POS (10)	Nothing	All
POS (10)	Internet	DNS, NTP, TCP 443 to vendor allowlist	All other outbound
POS (10)	Office (30)	Nothing (unless required)	All
Office (30)	POS (10)	POS admin ports (limited sources)	Everything else
Any	Firewall mgmt	IT admin IPs only	Everyone else

If you want more examples of how teams structure segmentation policies, this network segmentation examples guide is a good mental model, then you tailor it to restaurant reality.

Step 3: Guest isolation, mDNS traps, printers, and vendor support (without reopening the network)

Guest Wi‑Fi needs more than a different password. I enable a captive portal when it fits the brand, then I enforce client isolation so guest devices can’t talk to each other. I also set bandwidth limits per device so one person streaming doesn’t wreck tableside ordering.

mDNS (AirPrint, Chromecast, Sonos) is where restaurants get burned. The easy fix is turning on “mDNS across VLANs” everywhere, which also becomes a shortcut for lateral movement. My safer approach is to keep casting and guest media features inside the Guest VLAN only, or use an mDNS gateway that’s locked to only the service types you need, and only between two specific VLANs.

Printers and KDS are the next common exception. When a POS terminal must print to a device on another VLAN, I allow the smallest path possible:

• POS to printer: allow only required ports (often TCP 9100, LPD 515, or IPP 631), from POS subnet to the printer IP only.
• POS to KDS: allow only the vendor-required ports, and block KDS back to POS unless the vendor requires it.

For vendor remote access, I don’t open inbound ports. I use a VPN with MFA, or a jump host inside the Office VLAN with tight rules and logging. Time-boxed access beats a permanent hole.

This is also where I tie in the bigger IT picture. In my Small Business IT work, segmentation supports Cloud Infrastructure, Secure Cloud Architecture, and Cloud Management, because office systems often rely on SaaS and identity. When I’m doing an Office 365 Migration or broader Digital Transformation, I don’t want a POS issue spilling into email accounts. With Restaurant POS Support and Kitchen Technology Solutions, I pair Cybersecurity Services, Endpoint Security, and Device Hardening (patching, removing local admin, and turning off unused services). That’s part of being a long-term Business Technology Partner offering Technology Consulting, Tailored Technology Services, and Managed IT for Small Business, backed by Infrastructure Optimization, Data Center Technology experience, and IT Strategy for SMBs that prioritizes Business Continuity & Security.

Step 4: Validate the segmentation (and test failover before a Friday rush)

I validate in two ways: rule testing and “what can I see from here?” checks.

A simple test matrix keeps it honest:

Test from	Test to	Expected result
Guest device	POS IPs	Can’t ping, can’t connect
Guest device	Internet	Works (rate-limited)
Office PC	POS admin page	Works only from approved IP
POS terminal	Random internet site	Blocked unless allowlisted
POS terminal	Vendor endpoints	Works

I also test failover behavior. If you have a secondary WAN (LTE/5G), confirm VLANs keep the same rules during failover. Then verify your POS vendor’s offline mode and how it syncs once the link comes back.

Printable POS network segmentation checklist

• Confirm your firewall, switch, and APs support VLANs and 802.1Q trunking.
• Create VLANs for POS, Guest, and Office (and Kitchen/IoT if needed).
• Assign unique subnets and DHCP scopes per VLAN.
• Map SSIDs to VLANs, never share guest and POS credentials.
• Enable guest captive portal if desired, turn on client isolation.
• Set per-client bandwidth limits on guest Wi‑Fi.
• Set inter-VLAN policy to default-deny.
• Allow Guest to internet only, block all private LAN ranges.
• Restrict POS outbound to required vendor endpoints, DNS, and time sync.
• Block inbound internet to all VLANs, no port forwards, no exposed RDP.
• Add least-privilege exceptions for printers and KDS, pin to device IPs and required ports.
• Handle mDNS carefully, keep it local or tightly filtered across VLANs.
• Require VPN + MFA for vendor support, use a jump host if needed.
• Turn on DNS filtering for POS and Office.
• Patch network gear, POS endpoints, and office PCs on a schedule.
• Validate with a test matrix and a basic port scan from each VLAN.
• Test WAN failover behavior and document what breaks (then fix it).

A segmented restaurant network should feel boring. That’s the goal. With POS network segmentation, I get faster troubleshooting, tighter PCI scope, safer guest Wi‑Fi, and fewer late-night surprises.