Case Study: Coastal Resort Network Transformation

How ethical discovery, RF engineering expertise, and an economical approach transformed an 80-unit resort's network performance, security, and guest satisfaction

80 units
3-day implementation
€3,600 total cost

The Property

Property Type

Resort property: 60-room main building (4 floors) + 20 bungalows. Central pool, wetbar, tennis courts, lagoon-style pool. Outdoor area: 2 hectares (100m × 200m).

Location & Guest Profile

Leisure resort, established 2013. Mixed guest profile: families, couples, small groups. Typical stay 5-7 days. High expectations for connectivity across all areas.

IT Resources

No dedicated IT staff. Relied on local installation company for initial setup (2013) and ad-hoc support. Management handled basic troubleshooting.

Original Network (2013)

ISP: 500 Mbps fiber (GPON) with basic router
Core: Unmanaged 48-port Gb switch
Wi-Fi: 8 Netgear dual-band APs (866 Mbps, 2 per floor + 2 outdoor omni)
Security: 24 wired IP cameras (12 indoor, 12 outdoor)

How We Got Involved: Ethical Discovery

A Hatfree team member was staying at the resort as a guest. Out of curiosity—and some boredom—they ran a simple network scan from their phone to check Wi-Fi coverage quality.

Critical Security Finding

All devices were on the same unisolated network: guest phones, laptops, staff tablets, security cameras, POS terminals, booking system. The ISP router and main switch were both network-accessible. While password-protected, the network was essentially wide open internally—any compromised guest device could potentially access critical infrastructure.

Beyond the security concern, they also observed significant Wi-Fi performance issues:

  • Major dead spots throughout the resort
  • Pool-side rooms had noticeably poor coverage
  • Central pool area extremely slow despite nearby AP
  • Bungalows experienced random quality fluctuations

The Ethical Approach

Instead of probing further without permission, our team member approached the resort manager directly, introduced themselves as part of the Hatfree team, and shared the initial observations—particularly the security concern.

The manager was immediately interested. These issues matched ongoing guest complaints about connectivity. They invited our specialist to examine the equipment and discuss further.

Guest Complaints Confirmed

The manager shared specific recurring issues:

  • Main building: Frequent connectivity complaints, especially pool-side and middle-floor rooms
  • Pool area: Noticeably slow speeds despite proximity to AP
  • Bungalows: Random switches between excellent and unusable Wi-Fi
  • Overall frustration: Impacting guest satisfaction scores

After a brief on-site review of the existing equipment and placement, our specialist brought the case to the Hatfree team. We agreed to conduct the full assessment pro bono to establish the scope and build trust.

Two weeks later, with a signed NDA and service contract in place, the same specialist returned for a comprehensive 7-step assessment.

Assessment Findings: Deep Technical Issues

1. No VLAN Network Segmentation

Risk Level: Critical

  • All 24 security cameras on same network as guests
  • POS terminals, booking system, staff devices all reachable from guest network
  • No broadcast isolation—devices could discover each other
  • ISP router admin interface accessible from any connected device
  • Core switch accessible via default management interface

2. Weak, Feature-Lacking Router

Impact: No QoS, no VLAN support, minimal firewall, consumer-grade ISP equipment

  • Unable to prioritize business-critical traffic (POS, booking system)
  • No bandwidth management per network segment
  • Limited connection tracking causing session drops under load
  • No traffic analysis or logging capabilities

3. Water Refraction Effect (RF Issue)

The Discovery: This was the breakthrough finding that explained most Wi-Fi complaints.

The large central pool was causing significant RF signal refraction and multipath interference. Water is highly absorptive at 2.4 GHz and especially at 5 GHz. The result:

  • Pool-side rooms in main building experienced 40-60% signal degradation
  • Pool area AP was essentially "screaming into water" with 5 GHz enabled
  • Reflections off water surface created dead zones and unpredictable coverage
  • Lagoon-style pool near bungalows caused similar but mobile interference patterns

4. Poor RF Frequency Planning

  • Channel overlap: APs on same floor using overlapping 2.4 GHz channels (causing co-channel interference)
  • 40 MHz channels on 2.4 GHz: Massive bandwidth waste and interference in dense environment
  • Excessive power: APs set to max power, causing "cell breathing" and sticky client issues
  • No band steering: Clients camping on crowded 2.4 GHz when 5 GHz available

5. Unmanaged Core Switch

48-port Gigabit switch was entry-level unmanaged model. No VLAN support, no link aggregation, no monitoring, no redundancy. Single point of failure for entire resort network.

6. Suboptimal AP Placement

  • Only 2 APs per floor in main building—insufficient for 15 rooms/floor
  • Bungalows: sparse coverage with 2 omni APs trying to cover 100m+ distances
  • Outdoor APs placed for "coverage" without considering interference
  • No consideration for building materials, water features, or guest density

Solution: Practical, Economical, Effective

Our Philosophy for This Project

While a complete hardware refresh would have been ideal, we prioritized economic sustainability. The existing APs were capable—just misconfigured. The cabling infrastructure was sound. The cameras worked fine.

We focused investment where it mattered most: intelligent routing, managed switching, proper segmentation, and RF optimization. This approach delivered massive improvements at a fraction of the cost of a full replacement.

Equipment Added (€1,600)

Core Infrastructure

  • 1× MikroTik RB1100AHx2 (RISC processor, hardware QoS, VLAN support, 13 Gb ports)
  • 1× 48-port managed Gb switch with VLAN support
  • 1× 24-port managed Gb switch for bungalow segment

Wi-Fi Expansion

  • 4× Netgear omni APs (same model as existing, for consistency)
  • 4× Netgear indoor APs (for main building floors)
  • PoE accessories & outdoor enclosures

Configuration Changes (The Real Magic)

Network Segmentation (VLANs)

  • VLAN 10: Guest Wi-Fi (isolated, internet-only, bandwidth limited)
  • VLAN 20: Staff devices (isolated from guests, access to POS/PMS)
  • VLAN 30: Business systems (POS, PMS, booking—no guest access)
  • VLAN 40: Security cameras (isolated, dedicated bandwidth, recording server only)
  • VLAN 50: Management (switch/router/AP access, admin-only)

RF Optimization: Solving the Water Problem

  • 5 GHz disabled on all outdoor omni APs near water features
  • Power reduced by 50% on all pool-adjacent APs to prevent over-radiation into water
  • 2.4 GHz channels: Strict non-overlapping (1, 6, 11) with 20 MHz width only
  • 5 GHz channels: DFS channels utilized for less interference, proper spacing
  • Client isolation enabled on all guest SSIDs (even within same VLAN)

AP Placement & Density

  • Main building: Increased from 2 to 4 APs per floor (now ~4 rooms per AP)
  • Camera poles repurposed: Installed omni APs on existing outdoor infrastructure
  • Bungalow area: 4 additional omni APs for denser, more uniform coverage
  • Coverage strategy: More APs at lower power = better quality, less interference

MikroTik QoS & Traffic Management

  • Priority queues: Business VLAN (POS/PMS) gets guaranteed bandwidth
  • Guest bandwidth limits: Fair sharing per client (no single device hogging connection)
  • Camera traffic shaped: Dedicated bandwidth, doesn't impact guest experience
  • Firewall chains: Strict inter-VLAN rules, guest isolation, admin access control

Implementation: 3 Days On-Site

  • Day 1: New router and switches installed, VLANs configured and tested, existing APs reconfigured
  • Day 2: New APs installed (reusing existing cable conduits and camera poles), RF survey and fine-tuning
  • Day 3: Final testing, staff training, documentation handover, monitoring setup

Total labor cost: €2,000 (single specialist, 3 days on-site + 1 day remote pre-config and follow-up)

Results: Massive Quality Gain

The resort management reported that the improvements exceeded their expectations. Guest complaints about Wi-Fi dropped dramatically, and the network felt "invisible"—which is exactly what good infrastructure should be.

Guest Wi-Fi Complaints

~80% ↓

From daily complaints to occasional minor issues. Pool area and bungalows transformed from problem zones to satisfaction drivers.

Coverage Quality

95%+

Consistent signal strength throughout property. Dead spots eliminated. Bungalows now have reliable, stable connectivity.

Network Security

5 VLANs

Full segmentation. Guests isolated from cameras, POS, PMS. Client isolation active. Attack surface reduced by ~90%.

Staff Efficiency

Minimal

Front desk no longer handles constant Wi-Fi troubleshooting. Management has visibility into network health via MikroTik dashboard.

Equipment Reuse

75%

8 original APs retained and optimized. All cabling reused. Cameras untouched. Sustainable, economical approach.

Total Investment

€3,600

€1,600 equipment + €2,000 labor. Fraction of full hardware refresh cost while achieving comparable results.

🏆Our Pride

This project exemplifies the Hatfree philosophy: smart engineering over wasteful spending. We could have recommended a complete hardware overhaul—new controller-based Wi-Fi system, all new APs, managed switches everywhere. That would have cost €15,000-20,000.

Instead, we diagnosed the root causes (water refraction, poor RF planning, no segmentation), reused what worked, and invested strategically where it mattered. The result: enterprise-grade performance at SMB cost, with an economical and sustainable approach.

Key Takeaways

Ethical Discovery Works

Our specialist could have exploited the open network. Instead, they approached management transparently. This built immediate trust and led to a long-term client relationship.

RF Engineering Matters

Understanding physical RF behavior (water refraction, channel overlap, power management) was more valuable than expensive equipment. Physics beats marketing specs.

Segmentation is Essential

A flat network is a security disaster waiting to happen. VLANs are free (just configuration) and deliver massive security improvements. No excuse to skip this.

Economic != Cheap

Reusing functional hardware isn't cutting corners—it's smart resource allocation. We invested in intelligence (router, managed switches) and optimized the rest.

Ready for similar improvements?

Whether you're experiencing guest complaints, security concerns, or just want an objective assessment of your network, we can help. Ethical, practical, and economical—that's the Hatfree way.

Request a Free Assessment