Setting up a small business network is one of those tasks that looks simple until you're staring at three browser-based admin panels and a stack of Ethernet cables. Done right, the network becomes invisible: everything connects, stays connected, and doesn't expose your business to unnecessary risk. Done wrong, it's the thing you're fixing every other week. This guide covers the essential equipment and the specific configuration steps that matter most for a business environment.
What you actually need before you buy anything
The biggest mistake small business owners make is buying equipment before mapping their requirements. Start with three numbers: how many wired devices, how many wireless devices, and how many simultaneous users will be on the network at peak hours. A 5-person office and a 50-person office both use "small business" gear, but the hardware that suits one will choke on the other.
Also decide whether staff and customers will share a network. If customers need Wi-Fi access, you'll want separate infrastructure or at least a properly isolated guest network. Mixing staff and guest traffic on the same broadcast domain is a security problem, not just a performance one.
The core equipment for a small business network
A business-grade setup needs four things: a modem (or modem-router combo from your ISP), a dedicated router, a managed switch, and one or more wireless access points. Consumer gear sold at retail often bundles all of these into one box. That's fine for a home, but a single failure point for a business.
- Router: This handles traffic between your internal network and the internet. Business routers from Ubiquiti or similar vendors support VLANs, firewall rules, and VPN endpoints that consumer routers don't.
- Managed switch: A managed switch lets you segment traffic into VLANs (virtual LANs), set port priorities, and monitor bandwidth per port. An 8-port or 16-port managed switch covers most small offices.
- Wireless access points (APs): Standalone APs give you better coverage and control than a router's built-in Wi-Fi. Mount them centrally, away from thick concrete walls and metal shelving.
For internet connectivity, your ISP will provide the modem. Ask for a business-grade plan with a static IP if you plan to run any services that outside staff or systems need to reach, such as a VPN or a hosted application.
Cabling and physical layout
Cat6 Ethernet cable is the standard for new installations. It supports gigabit speeds reliably across runs up to 100 metres, which covers most office floorplans. Run cables inside walls or through cable trays rather than across the floor where they'll get damaged. Label every cable at both ends before you terminate it. This saves hours later.
Keep the network cabinet or patch panel away from heat sources and in a ventilated space. Switches and routers generate heat, and a hot closet will shorten the life of every piece of hardware in it. If you're in a leased space, check whether structured cabling already exists. Many commercial buildings have Cat5e or Cat6 runs in place.
Wired connections outperform wireless for desktop workstations, printers, and servers. Reserve Wi-Fi for laptops, mobile devices, and areas where cabling isn't practical. For a detailed look at the performance difference, the article on Ethernet vs Wi-Fi: which is better for speed and reliability breaks down where each one makes sense.
Router and VLAN configuration
Once the hardware is in place, the router is where most of the important configuration happens. Log into the admin interface (usually at 192.168.1.1 or 192.168.0.1) and work through these steps in order.
First, change the default admin credentials. Every router ships with a known default username and password. Leaving these in place means anyone who can reach the admin interface owns your network.
Second, set up VLANs to separate traffic types. A typical small business setup has three: a staff VLAN for workstations and printers, a server VLAN for any on-premise file or application servers, and a guest VLAN for visitor Wi-Fi. Configure firewall rules so the guest VLAN can reach the internet but not the staff or server VLANs. This prevents a compromised guest device from accessing your internal systems.
Third, disable any services you don't use. Universal Plug and Play (UPnP) and remote management over the WAN interface are both enabled by default on many routers. Turn them off unless you have a specific reason to keep them on.
Wireless access point setup
Each VLAN that needs wireless access gets its own SSID (network name). The staff SSID uses WPA3 or WPA2-Enterprise authentication; the guest SSID uses WPA2 with a separate pre-shared key. Don't broadcast the staff SSID if your access points let you hide it. It's not a security measure on its own, but it reduces casual attempts to connect.
Place access points so their coverage areas overlap by about 20 percent. Too much overlap and devices will struggle to roam cleanly between APs; too little and you get dead zones. For a single-floor office under 300 square metres, one or two APs is usually enough. For larger or multi-floor spaces, see the guide on how to improve Wi-Fi coverage in large spaces for placement strategies that apply equally well to offices.
Set the 5 GHz band as the preferred band for capable devices. It's faster and less congested than 2.4 GHz in most office environments. Keep 2.4 GHz enabled for older devices and hardware that doesn't support 5 GHz.
DHCP, DNS, and static assignments
Your router runs a DHCP server that assigns IP addresses to devices automatically. For workstations and laptops, automatic assignment is fine. For printers, servers, and network-attached storage, assign static IP addresses (or use DHCP reservations tied to the device's MAC address). A printer that changes its IP address breaks every computer that has it configured.
Set your DNS servers to something reliable. Google's public DNS (8.8.8.8 and 8.8.4.4) or Cloudflare's 1.1.1.1 both work. Some business routers also support DNS filtering services that block known malicious domains at the network level, which adds a layer of protection without installing anything on individual devices.
Security configuration you shouldn't skip
A small business network is a target. It doesn't matter if you're a 3-person accounting firm or a 40-person logistics company: attackers scan for exposed devices constantly. A few configuration steps make a significant difference.
Enable the firewall on your router and block inbound connections by default. Only open specific ports for services that genuinely need external access. If staff need to connect remotely, set up a VPN rather than exposing Remote Desktop or file shares directly to the internet. Keep router and switch firmware updated; manufacturers push patches for known vulnerabilities, and unpatched firmware is a common entry point.
Network security sits alongside endpoint security. The article on the small business cybersecurity checklist covers the endpoint and policy side of the picture, which pairs directly with the network hardening steps above.
Testing before you go live
Before staff rely on the network, test it deliberately. Confirm that a device on the guest VLAN cannot ping devices on the staff VLAN. Check that all wired ports deliver the speeds you expect using a tool like iPerf3. Walk the office with a laptop to confirm there are no Wi-Fi dead zones. Run a speed test from multiple points to verify the internet connection is performing to spec.
Document the final configuration: IP address ranges per VLAN, the location of each access point, the credentials stored in your password manager, and the support contact for each piece of hardware. A network that works but isn't documented is one support call away from being rebuilt from scratch.