Suppose you have a small office with a network, and want to set up a public Wi-Fi hotspot. The single most important requirement is that people who use the Wi-Fi hotspot should not be able to access the office network.
There are many ways to set up a network to do this, depending on the functionality that is required. Also, if you are setting up a commercial hotspot, you should get the advice of the Wi-Fi network provider you will be working with in planning the hotspot (unless you expect to be doing service provisioning yourself). You should also know that there are a number of turn-key "put up a hotspot" kits available, which you can buy and not have to think about further.
In any case, the key concept to protect the private network is the DMZ. DMZ is a term borrowed from the military that is short for demilitarized zone. In networking terms, it means a computer or subnetwork that sits between an internal network that needs to remain secure and an area that allows external access, for example a Web server or a Wi-Fi hotspot.
Figure 15.15 shows a simple model of a DMZ that uses firewalls to protect the private network both from the Internet and from users of the public Wi-Fi hotspot.