Setting Up a Secure Network for Your Kiosk

Running a HootBoard kiosk requires a reliable and secure network connection to ensure optimal performance, even though HootBoard OS is built with an offline-first architecture. This comprehensive guide serves both non-technical staff who need to understand networking basics and IT administrators who will handle the technical implementation.

Important: Public WiFi networks and captive portal networks (those requiring login pages) are not suitable for kiosks due to security vulnerabilities and reliability issues. This guide focuses exclusively on private, secure network solutions.

Quick Start: Network Option Priority Matrix

Choose the highest-priority option that fits your technical capabilities and deployment constraints:

Priority	Network Option	Reliability	Security	Setup Complexity	Best When
🥇 1st	Direct Ethernet Cable	Excellent	Excellent	Medium	Permanent location, cable access available
🥈 2nd	Dedicated Hidden WiFi	Excellent	Excellent	High	High security needs, wireless required
🥉 3rd	Isolated Network Section	Very Good	Excellent	High	Strong existing network infrastructure
4th	WiFi-to-Ethernet Hotspot	Very Good	Good	Low	Secure area, cabling impractical
5th	Internal Company WiFi	Good	Good	Low	Simple setup, trusted environment
6th	Restricted Guest Network	Fair	Fair	Very Low	Quick deployment, temporary use

Start from the top and work your way down based on what's feasible for your situation.

---

For Non-Technical Staff: Understanding Your Options

Your kiosk needs a stable, secure internet connection to function properly. Below are six proven network solutions, each designed to maintain security and reliability while avoiding problematic public networks.

Option 1: Direct Ethernet Cable Connection 

What it is: A physical network cable connecting your kiosk directly to your network infrastructure.

Key Benefits:

• Maximum reliability with no wireless interference
• Highest security with direct connection
• Consistent high-speed performance

What you need:

• Verify kiosk location near existing network port, or
• Arrange for IT team to install cable to kiosk location
• Ensure physical security of cable connection

Best for: Smart city kiosks, university campus information stations, hotel lobby check-ins, or any permanent installation requiring 24/7 reliability.

Option 2: Dedicated Hidden WiFi Network 

What it is: A private WiFi network created exclusively for your kiosk, invisible to other devices.

Key Benefits:

• Complete isolation from other devices
• Hidden network prevents unauthorized access attempts
• Dedicated bandwidth ensures consistent performance

What you need:

• Share kiosk's WiFi details with your IT team
• Ensure kiosk placement within 50-100 feet of the access point
• Minimize walls and obstacles between kiosk and access point

Best for: DMO visitor centers, tourism information kiosks, smart city installations, or any high-traffic public environment where data protection and network separation are critical.

Option 3: Isolated Network Section with Device Verification

What it is: A separate "zone" within your existing network that only recognizes your specific kiosk by its unique device fingerprint (MAC address).

Key Benefits:

• Leverages existing network infrastructure
• Provides strong security through device identification
• Maintains dedicated bandwidth for kiosk operations

What you need:

• Locate your kiosk's MAC address in network settings (format: 00:1A:2B:3C:4D:5E)
• Provide this MAC address to your IT team for configuration
• Verify your current network has sufficient capacity

Best for: Corporate workplaces, university campuses, or large organizations with robust IT infrastructure who want maximum security without additional hardware costs.

Option 4: Internal Company WiFi

What it is: Connecting your kiosk to your organization's private internal WiFi network.

Key Benefits:

• Uses existing infrastructure
• Quick setup process
• Secure when properly configured

What you need:

• Confirm network uses strong encryption (WPA3 or WPA2)
• Verify sufficient bandwidth for kiosk operations
• Provide WiFi credentials to IT team for kiosk connection

Best for: Churches, community centers, smaller corporate offices, or organizations wanting rapid deployment with volunteer-friendly maintenance.

Option 5: WiFi-to-Ethernet Hotspot (Secure Areas Only)

What it is: A bridge device that connects to your WiFi network and provides a wired connection to your kiosk.

Key Benefits:

• Combines wireless flexibility with wired reliability
• Ideal when running cables is impractical
• Maintains stable connection performance

What you need:

• Ensure kiosk is in a physically secure, monitored location
• Verify strong WiFi signal at the bridge device location
• Allow IT team to configure and secure the bridge device

Best for: Hotel guest services kiosks, conference centers, workplace break areas, or any location where the kiosk is in a secure area but cable installation is challenging.

Option 6: Restricted Guest Network

What it is: A guest WiFi network configured to allow only your specific kiosk to connect.

Key Benefits:

• Simpler setup than dedicated networks
• Good security through access restrictions
• Keeps kiosk separate from main network

What you need:

• Provide kiosk's MAC address to IT team
• Verify guest network isolation from internal systems
• Confirm adequate bandwidth allocation

Best for: Conference centers, temporary events, university student centers, or organizations with existing guest networks seeking a balance between security and quick deployment.

Market-Specific Considerations

DMO & Tourism Centers

• High visitor traffic requires separation from public WiFi
• Multilingual content may need higher bandwidth
• Seasonal variations in usage patterns
• Integration with local tourism databases and booking systems

Smart Cities & Public Kiosks

• 24/7 operation demands maximum reliability
• Weather resistance for outdoor installations
• Vandal-resistant network connections
• Remote monitoring capabilities essential
• Integration with city services and emergency systems

Corporate Workplaces

• Security compliance with corporate IT policies
• Integration with existing network infrastructure
• Scalability for multiple department deployments
• Employee authentication systems compatibility

Hotels & Guest Management

• Separation from guest WiFi networks
• Integration with property management systems
• Flexible placement in lobbies, conference rooms, concierge areas
• Multi-property management capabilities

Churches & Community Centers

• Volunteer-friendly setup and maintenance
• Budget-conscious solutions
• Simple troubleshooting procedures
• Integration with event management and donation systems

Universities & Campus

• Large-scale deployments across multiple buildings
• Integration with student information systems
• Compliance with educational IT security standards
• Support for high-density user environments

Important Guidelines for All Options

• Public WiFi (cafes, airports, retail locations) - Security risks and unreliable connections
• Captive Portal Networks (hotels, conference centers) - Login pages disrupt kiosk operations
• Shared Networks without proper isolation - Risk of interference and security breaches

✅ Essential Requirements:

• Work with IT: Share this guide with your technical team for proper implementation
• Test Thoroughly: Verify internet connectivity and all kiosk functions after setup
• Monitor Performance: Regularly check that the kiosk maintains stable connections
• Plan for Support: Ensure your IT team can troubleshoot network issues

Getting Help

If you need assistance choosing the best option for your environment or coordinating with your IT team, contact our support team at [e-mail].

---

For IT Administrators: Technical Implementation

This section provides detailed configuration instructions for each network option. All approaches prioritize security and reliability while avoiding public networks and captive portals.

Prerequisites

• Kiosk MAC Address: Located in the device's network settings (format: XX:XX:XX:XX:XX:XX)
• Bandwidth Requirements: 10-50 Mbps depending on application and content
• Security Requirements: WPA3 preferred, WPA2 minimum (never WEP or open networks)

---

Option 1: Dedicated Hidden WiFi Access Point

Creates an isolated, invisible WiFi network exclusively for the kiosk.

Hardware Requirements

• Business-grade access point (Ubiquiti UniFi, Cisco Meraki, TP-Link Omada)
• PoE switch or power adapter
• Network cable for AP backhaul

Configuration Steps

1. Access Point Setup:

# Basic AP Configuration for High-Traffic Environments
SSID: HootBoard_[Location]_Secure (hidden)
Security: WPA3-Personal (or WPA2 if WPA3 unavailable)  
Passphrase: [Strong 12+ character password]
Channel: Auto (5GHz preferred) or 1/6/11 (2.4GHz)
Band: 5GHz recommended for less congestion in public spaces

2. Network Isolation:

• Enable SSID hiding (disable broadcast)
• Configure client isolation
• Create dedicated VLAN (e.g., VLAN 10)
• Assign static management IP (e.g., 192.168.1.10)

3. Security Hardening:

• Disable WPS
• Enable MAC address filtering (kiosk MAC only)
• Configure firewall rules for necessary traffic only
• Set up monitoring and logging

4. Kiosk Connection:

• Manually configure WiFi settings on kiosk
• Verify connection stability and performance
• Test all required applications and services

Validation Checklist

• [ ] AP is invisible to device scans
• [ ] Only kiosk can authenticate
• [ ] Network performance meets requirements
• [ ] Management access secured

---

Option 2: Isolated Subnet with MAC Address Filtering

Isolates the kiosk on a dedicated network segment with strict access controls.

Network Design

# Example for University/Corporate Environment
Main Network: 192.168.1.0/24
HootBoard Subnet: 192.168.10.0/24 (VLAN 20)
Gateway: 192.168.10.1
DHCP Pool: 192.168.10.100-200
DNS: Internal + Public fallback

Configuration Steps

1. VLAN Creation (Cisco Example for Campus/Corporate):

vlan 20
  name HOOTBOARD_KIOSKS
  description "HootBoard Kiosk Network Segment"
exit

interface vlan 20
  ip address 192.168.10.1 255.255.255.0
  description "HootBoard Kiosk Gateway"
  no shutdown
exit

2. DHCP Configuration:

ip dhcp pool HOOTBOARD_KIOSKS
  network 192.168.10.0 255.255.255.0
  default-router 192.168.10.1
  dns-server 192.168.1.10 8.8.8.8  # Internal DNS + Public fallback
  lease 7  # 7-day lease for stable connections
exit

3. MAC Address Filtering:

interface gigabitethernet0/1
  description "HootBoard Kiosk - [Location]"
  switchport mode access
  switchport access vlan 20
  switchport port-security
  switchport port-security maximum 1
  switchport port-security mac-address [HOOTBOARD_MAC]
  switchport port-security violation restrict
exit

4. Firewall Rules:

• Block inter-VLAN communication
• Allow only necessary outbound traffic
• Log and monitor access attempts

Validation Checklist

• [ ] HootBoard receives correct IP assignment
• [ ] MAC filtering prevents unauthorized access
• [ ] VLAN isolation verified
• [ ] Required services accessible (HootBoard cloud, content servers)
• [ ] Performance meets application requirements

---

Option 3: Internal Company WiFi

Connects kiosk to existing secure internal WiFi with additional security measures.

Prerequisites Verification

# Check network security
Security Protocol: WPA3/WPA2 ✓
Encryption: AES ✓
Authentication: Strong passphrase ✓
Signal Strength: >-70 dBm ✓

Configuration Steps

1. Network Assessment:

• Verify WiFi security settings
• Check available bandwidth and capacity
• Test signal strength at kiosk location
• Review existing QoS policies

2. Security Enhancement:

# Enable client isolation
# Configure MAC address filtering (optional)
# Set up network monitoring
# Apply firewall rules for kiosk traffic

3. Kiosk Configuration:

• Configure WiFi credentials
• Set static IP (recommended) or use DHCP
• Verify DNS resolution
• Test application connectivity

4. Quality of Service (QoS):

# Prioritize kiosk traffic
# Set bandwidth limits if needed
# Monitor network performance

Validation Checklist

• [ ] Secure connection established
• [ ] Performance meets requirements
• [ ] Client isolation active
• [ ] Monitoring in place

---

Option 4: Direct Ethernet Connection

Provides maximum reliability through wired network connection.

Cable Installation

• Cable Type: Cat6 (recommended) or Cat5e minimum
• Maximum Distance: 100 meters
• Installation: Professional cable run recommended

Configuration Steps

1. Switch Port Configuration (Cisco Example for Campus/Corporate):

interface gigabitethernet0/2
  description "HootBoard Kiosk - [Building/Room]"
  switchport mode access
  switchport access vlan 30
  switchport port-security
  switchport port-security maximum 1
  switchport port-security mac-address [HOOTBOARD_MAC]
  spanning-tree portfast  # Fast convergence for kiosk connections
  no shutdown
exit

2. VLAN Setup:

vlan 30
  name HOOTBOARD_WIRED
  description "HootBoard Wired Connections"
exit

interface vlan 30
  ip address 192.168.30.1 255.255.255.0
  description "HootBoard Wired Gateway"
  no shutdown
exit

3. IP Configuration:

• Static IP assignment: 192.168.30.100
• Gateway: 192.168.30.1
• DNS: Corporate or public DNS servers
• Subnet mask: 255.255.255.0

4. Security Measures:

• Port security with MAC binding
• VLAN isolation
• Physical port security
• Monitoring and logging

Validation Checklist

• [ ] Cable integrity verified
• [ ] Link status active
• [ ] IP configuration correct
• [ ] Security measures active

---

Option 5: WiFi-to-Ethernet Hotspot (Secure Areas)

Uses a bridge device to convert WiFi to Ethernet for the kiosk.

Hardware Selection

Recommended Devices:

• TP-Link TL-WR902AC (travel router mode)
• Vonets VAP11G-300 (WiFi bridge)
• Ubiquiti UniFi Bridge (enterprise)

Configuration Steps

1. Bridge Device Setup:

# Initial configuration via web interface
Mode: Bridge/Client Mode
WiFi Network: [Internal SSID]
Security: WPA3/WPA2
Credentials: [Network password]

2. Network Configuration:

# Bridge device settings
IP Assignment: Static (192.168.1.20)
DHCP: Disabled on bridge
MAC Cloning: Enable if required
Firewall: Minimal (bridge mode)

3. Physical Security:

• Install in locked enclosure
• Secure mounting to prevent tampering
• Label for identification
• Document location and configuration

4. Kiosk Connection:

• Connect via Cat6 Ethernet cable
• Configure kiosk for DHCP or static IP
• Verify connectivity through bridge
• Test all required services

Security Considerations

• Physical Security: Bridge must be in secure, monitored area
• Network Security: Bridge inherits WiFi network security
• Access Control: Consider MAC filtering on WiFi network
• Monitoring: Regular checks for unauthorized access

Validation Checklist

• [ ] Bridge device secured physically
• [ ] WiFi connection stable (-70 dBm or better)
• [ ] Ethernet connection to kiosk active
• [ ] All services accessible through bridge

---

Option 6: Restricted Guest Network

Configures existing guest network with kiosk-specific restrictions.

Configuration Steps

1. Guest Network Security:

# Basic security settings
SSID: [Guest Network Name]
Security: WPA3/WPA2
Isolation: Client-to-client blocked
VLAN: Separate from internal network

2. Access Control:

# MAC address whitelist
Allowed Devices: [KIOSK_MAC_ADDRESS]
Access Schedule: 24/7 or business hours
Bandwidth Limit: As required

3. Network Isolation:

• Block access to internal networks
• Allow only internet access
• Restrict to necessary ports/protocols
• Monitor for unauthorized devices

4. Firewall Rules:

# Allow outbound rules
HTTP/HTTPS: Allow to required domains
DNS: Allow to specified servers
Block: All other protocols
Log: All connection attempts

Validation Checklist

• [ ] Only kiosk can connect to guest network
• [ ] Internal network isolation verified
• [ ] Required services accessible
• [ ] Unauthorized access blocked

---

Network Monitoring and Maintenance

Essential Monitoring Points

• Connection Status: Continuous uptime monitoring
• Bandwidth Usage: Track data consumption patterns
• Security Events: Monitor for unauthorized access attempts
• Performance Metrics: Latency, packet loss, throughput

Maintenance Schedule

• Daily: Automated connectivity checks
• Weekly: Performance review and optimization
• Monthly: Security audit and firmware updates
• Quarterly: Full network assessment and documentation update

Troubleshooting Quick Reference

Issue	Check	Resolution
No connectivity	Cable, WiFi signal, IP config	Verify physical connections, check network settings
Slow performance	Bandwidth, interference, QoS	Optimize channel selection, adjust QoS policies
Security alerts	MAC filtering, firewall logs	Review access logs, update security rules
Intermittent issues	Signal strength, hardware health	Check hardware status, optimize placement

Documentation Requirements

• Network topology diagrams
• IP address assignments
• Security configurations
• Contact information for support
• Change management procedures

---

Support and Additional Resources

For technical questions or implementation assistance, contact our support team:

Email: [e-mail]
Include: Network configuration details, kiosk model, specific issues or questions

Our team can provide additional guidance on complex network environments, security requirements, and performance optimization for your HootBoard kiosk deployment.