How to Set Up Starlink for a Small Office: Staff, Guest and IoT Networks

Why a small office needs more than one Wi-Fi password

A small office can run well on Starlink, but putting laptops, visitors, printers, cameras and smart devices on one flat network makes faults and security harder to contain. A better setup gives each group a separate network and a simple rule for what it is allowed to reach.

This guide is vendor-neutral. The labels in your router or firewall may be called networks, VLANs, SSIDs, guest access or client isolation.

Before you change anything

Collect these details first:

• Which Starlink kit and router are installed, and whether a separate router or firewall already manages the office network.
• The current Wi-Fi name and password, the router login, and a way to reconnect locally if a change fails.
• Which devices must talk to each other, such as staff laptops to a printer or a management computer to a local NAS.
• Which devices only need internet access, such as visitor phones, displays, plugs or cameras.
• A short maintenance window. Keep one laptop connected by Ethernet or have a second administrator device available while testing.

Export or write down the current router settings before changing the layout. Do not factory-reset Starlink or a third-party router just to create separate networks.

Choose a simple layout

Use one routing device as the network authority. It should provide DHCP, firewall rules and the separate Wi-Fi or wired networks.

| Network | Typical devices | Default access | | --- | --- | --- | | Staff | Work laptops, phones and approved workstations | Internet plus only the internal services that are needed | | Guest | Visitor phones and personal devices | Internet only | | IoT | Cameras, displays, smart plugs and other managed devices | Internet only, plus carefully chosen access from an admin device |

If you use the Starlink router for routing, create a guest network there if the model supports it and use its isolation controls. If a third-party router or firewall is the office router, connect Starlink to its WAN port and let that device create the networks. Use Starlink bypass mode only when your model and layout support it and you have recorded how to undo the change.

Avoid running two independent DHCP servers on the same LAN. That causes devices to receive unpredictable addresses and can make printers, cameras and management pages appear to vanish.

Create the networks

1. Create a staff network with a strong, unique password. Use a different name and password from any old office Wi-Fi so devices do not silently reconnect to the wrong network.
2. Create a guest network. Turn on client isolation if the router offers it, and disable access to local network devices.
3. Create an IoT network if the router supports separate SSIDs or VLANs. Put cameras, displays, plugs and other devices that do not need to manage laptops there.
4. Use separate DHCP ranges or VLANs. The exact numbers do not matter; what matters is that the networks are genuinely separate and do not overlap.
5. Keep router, firewall, Starlink and switch administration on the staff or management side. Do not expose management pages to guests or untrusted IoT devices.
6. Reconnect one test laptop to the staff network before moving the rest of the office. Confirm it receives an address and can browse the internet.

Add only the traffic that is needed

Start with deny-by-default access between networks, then add small exceptions:

• Allow staff devices to reach a printer only if printing is required.
• Allow an approved admin device to reach the IoT management pages, but do not allow every guest or staff device to manage IoT equipment.
• Allow a camera or display to reach its required cloud service if it needs internet access.
• Do not expose a router, camera, NAS or remote-management page directly to the internet to solve a discovery problem.
• Treat discovery protocols carefully. A printer may need a router feature such as mDNS or an explicit print queue to be visible across networks.

If a device stops working, add one narrowly scoped rule after identifying what it needs. Avoid opening an entire network to make one device work.

Control shared Starlink capacity

Starlink capacity changes with location and congestion, and uploads can affect everyone more quickly than an occasional download. On the office router:

• Reserve the most important traffic for interactive work such as calls, remote desktops and point-of-sale services.
• Schedule large cloud backups, operating-system updates and media uploads outside busy hours where possible.
• Use per-network or per-device bandwidth limits for guests and nonessential IoT devices if the router supports them.
• Measure the result from a wired staff device at a quiet time and during a busy period. Do not treat one speed test as a permanent service guarantee.

The goal is a usable office during busy periods, not a promise that every device receives the same speed.

Test before handing it over

Run these checks from each network:

1. Staff: browse the internet, reach required printers or internal services, and confirm that administration is available only to the intended administrator.
2. Guest: browse the internet, then try to reach a staff laptop, printer and router login. Those local attempts should fail.
3. IoT: verify that each device reaches its required service. From a normal staff laptop, confirm that the device is not exposing an unnecessary management interface.
4. Recovery: unplug and reconnect the router or access point in the normal way. Confirm that DHCP, Wi-Fi and the required devices return without manual reconfiguration.
5. Load: start a controlled upload or download and check whether a voice or video call remains usable. Stop the test if the network becomes unstable.
6. Documentation: record network names, where each device belongs, the exception rules, and the physical location of the routing equipment.

Test with a real guest phone and at least one wired device. Wi-Fi roaming, private addressing and device sleep modes can hide problems that a single laptop test will miss.

If something breaks

• If no device gets an address, check for a second DHCP server or a VLAN-to-port mismatch.
• If staff can browse but cannot print, confirm the printer's address and whether discovery is blocked between networks. A fixed address or a print queue is usually safer than opening the entire LAN.
• If IoT devices lose access after isolation is enabled, allow only the required outbound service or the admin path. Do not move the device back to the staff network by default.
• If guests can see office devices, disable local-network access on the guest network and check that the access point is carrying the guest network correctly.
• If the whole office loses internet after a routing change, reconnect to the saved configuration or restore the previous WAN and DHCP settings. Make one change at a time.

A maintainable small-office baseline

A sensible baseline is:

• Staff, guest and IoT networks are separate.
• Router and Starlink administration is restricted to a trusted device.
• Guest access is isolated from local devices.
• Large transfers are scheduled or rate-limited.
• Firmware, router backups and administrator contact details are recorded.
• The office keeps a tested fallback, such as a phone hotspot or another WAN, for a Starlink outage.

Review the device list and exception rules every few months. Remove old guest access and retired devices, rotate shared passwords when staff change, and retest isolation after router or access-point updates.