UniFi Expert Needed to Configure Voucher Wi-Fi, VLANs and Secure Staff Network for Guesthouse

UniFi Expert Required – Separate Voucher Wi-Fi and Secure Staff Network for Guesthouse We are looking for an experienced Ubiquiti UniFi network specialist to remotely configure and secure an existing network installation. Current Setup We currently operate a student residence where internet access is managed through a UniFi Cloud Gateway and UniFi Network Controller. Students access the internet using vouchers. We are extending the internet connection from the student residence to a nearby mini guesthouse using a Ubiquiti LiteBeam wireless bridge. The proposed guesthouse setup is: UniFi Cloud Gateway → LiteBeam wireless bridge → UniFi managed Flex switch → router/access point → Reyee wireless access point Required Guesthouse Networks The guesthouse must operate separately from the student residence network. Two separate types of internet access are required at the guesthouse: 1. Guest Voucher Network Guesthouse visitors must connect to a separate guesthouse Wi-Fi name and use vouchers to access the internet. The guest network must: - Have its own Wi-Fi name/SSID. - Be separate from the student residence Wi-Fi network. - Require voucher authentication. - Support voucher expiry periods, bandwidth limits and data limits. - Prevent guests from accessing the student residence network. - Prevent guests from accessing the UniFi controller or other network-management systems. - Prevent guests from seeing or accessing other guest devices. - Prevent guests from accessing any unrestricted guesthouse devices. 2. Unrestricted Network for Fixed Guesthouse Devices Certain authorised devices at the guesthouse must have unrestricted internet access without requiring vouchers. These devices may include: - Smart TVs. - The reservations laptop. - The guesthouse IP phone. - Printers or other approved operational devices. - Additional authorised staff or business devices. These devices must be placed on a separate secure network, VLAN or SSID. The unrestricted network must: - Have internet access without a voucher. - Be protected with a secure password or another suitable authentication method. - Be completely separated from the guest voucher network. - Not be visible or accessible to guesthouse visitors. - Prevent guests from using the unrestricted internet connection. - Prevent guests from communicating with the reservations laptop, IP phone, TVs or other fixed devices. - Allow selected fixed devices to communicate with each other only where operationally necessary. - Allow new authorised devices to be added easily in future. The freelancer must recommend whether the fixed devices should be managed through a separate trusted VLAN, a private staff SSID, fixed switch ports, device allowlisting or another secure method. Required Configuration The successful freelancer will be required to: - Create a separate VLAN and network for the guesthouse voucher users. - Create a separate trusted VLAN or network for unrestricted fixed devices. - Create a separate guesthouse voucher Wi-Fi name. - Create a secure staff or operational Wi-Fi network where required. - Configure unrestricted wired access for approved devices where required. - Ensure the guesthouse cannot access the student residence network, devices or management systems. - Configure voucher-based internet access for guesthouse visitors. - Configure separate guesthouse voucher durations, bandwidth limits and data limits. - Ensure each guesthouse user can be identified and authenticated individually. - Configure firewall rules between the student residence, guesthouse visitors and trusted guesthouse devices. - Configure guest isolation and client isolation. - Prevent voucher users from accessing unrestricted networks or devices. - Configure the UniFi Flex switch ports correctly for the required VLANs. - Confirm and configure the LiteBeam bridge correctly. - Advise whether the existing ordinary router should be removed or placed into bridge/access-point mode. - Confirm whether the Reyee access point can reliably support the required VLANs and UniFi voucher portal. - Test internet access, voucher authentication, VLAN separation and device isolation. - Provide a simple network diagram and documentation of the completed configuration. Important Requirements The freelancer must have proven experience with: - UniFi Cloud Gateways. - UniFi Network Controller. - UniFi captive portals and voucher systems. - VLANs and managed switches. - Firewall rules and network isolation. - Guest and client isolation. - Trusted device networks. - Ubiquiti airMAX LiteBeam point-to-point bridges. - Networks containing both UniFi and third-party access points. - IP phones and business-device networking. - Remote troubleshooting and configuration. The freelancer must first review the proposed topology and advise whether the current combination of the UniFi Flex switch, ordinary router and Reyee access point will allow individual UniFi vouchers, VLANs and secure network isolation to work correctly. We are open to removing or replacing the ordinary router or Reyee access point if necessary to create a reliable and secure system. Expected Deliverables 1. Fully functioning separate guesthouse network. 2. Separate guesthouse voucher Wi-Fi name. 3. Working guesthouse voucher portal. 4. Separate unrestricted network for approved fixed devices. 5. Unrestricted internet access for the TVs, reservations laptop, IP phone and other authorised devices. 6. Complete separation between guest users and unrestricted devices. 7. Complete separation from the student residence network. 8. Bandwidth and usage controls for voucher users. 9. Secure firewall, VLAN and switch-port configuration. 10. Testing of multiple guest vouchers and unrestricted devices. 11. Network diagram and configuration notes. 12. Brief instructions showing our staff how to create vouchers and add authorised fixed devices. Please include details of similar UniFi voucher, VLAN, trusted-device and LiteBeam installations you have completed.