SNAPguard
SNAPguard is the appliance that runs the guest network. It hangs off the venue’s existing router, owns the guest VLAN and serves the sign-in page locally, while Stampede provisions and monitors it remotely.
When you'd use it
It runs on every Guest Wi-Fi deployment, whether the box is the only Wi-Fi in the building or a managed switch and the venue’s own access points already carry the network. Read this to understand where it sits, how it is deployed and how Stampede keeps it healthy.
How it behaves
SNAPguard is a MikroTik appliance running Stampede’s own build. It plugs into a LAN port on the venue’s existing router, never the WAN port, and takes an address from that network like any other device. The venue’s router stays the gateway to the internet. SNAPguard is the gateway for guest devices only: it hands them addresses, serves the branded sign-in page locally so it stays fast, and passes their traffic upstream once they are signed in. Guest traffic is isolated from the till, back office and cameras, and card data on the venue’s own network never passes through it.
It deploys in one of two modes. Standalone, where the box is the only Wi-Fi in the building and broadcasts the guest network itself from its own ports. Or VLAN trunk, for venues with a managed switch and their own access points: one port carries the tagged guest VLAN alongside the native network, the venue’s UniFi, Omada or Ruckus access points broadcast the guest SSID, and SNAPguard handles guest DHCP and the captive portal only. Where there is a controller, the guest networks are mirrored into it so every access point broadcasts the right thing. The networks themselves, bandwidth and firewall rules are covered in Networks and traffic.
The box dials out to Stampede over an encrypted tunnel, so nothing inbound is opened on the venue’s firewall. From one console the team sees its health and session logs, pushes firmware automatically and provisions the networks remotely. A venue takes the box from Stampede as a one-off purchase, or an IT partner supplies a supported MikroTik and adds it through the guided setup wizard, with the venue’s current kit listed alongside, and it is enrolled and provisioned the same way. The box also scans the venue network and names every device on it by manufacturer, so the team can see the access points, speakers, printers, cameras and payment terminals present without a site visit.
Configuration and options
- Appliance
- A MikroTik box on Stampede’s build, bought from Stampede as a one-off or sourced by an IT partner from the supported models.
- Where it sits
- On a LAN port of the venue’s router. The router stays the internet gateway; SNAPguard is the gateway for guest devices only.
- Standalone mode
- The box is the only Wi-Fi and broadcasts the guest network itself.
- VLAN trunk mode
- One port carries the tagged guest VLAN; the venue’s own access points broadcast, SNAPguard does guest DHCP and the portal.
- Controller mirroring
- Guest networks pushed into UniFi, Omada or Ruckus so every access point broadcasts the right thing.
- Secure link
- An outbound encrypted tunnel for portal and control traffic; no inbound firewall changes.
- Provisioning
- Remote setup and go-live, with a guided wizard when a venue or partner adds its own device.
- Health and firmware
- Remote health monitoring and automatic firmware updates.
- Session logging
- Session records kept for acceptable-use and logging obligations.
- Network inventory
- A scan that names every device on the venue network by manufacturer.
- Networks and traffic
- Guest and staff networks, bandwidth and firewall rules; see Networks and traffic.
Good to know
SNAPguard is not the venue’s internet gateway. It hangs off the existing router and is the gateway for guest devices only, so there is no double-NAT on the venue’s own network.
In trunk mode the venue’s IT team tags the guest VLAN on the switch port SNAPguard plugs into and disables DHCP on that VLAN; SNAPguard handles guest DHCP itself.
Setup is hands-on with our team rather than a five-minute self-install, and when the box is offline, capture stops.