Marina Wi-Fi Arrival Checklist

Marina Wi-Fi can be useful when the yacht is alongside, but it should be treated as an untrusted shore network. It is not the yacht's core network, and it should not be allowed to create a casual bridge into owner office, management systems, bridge data, CCTV, AV control, or OT.

The safe approach is simple: connect through the yacht firewall, keep marina Wi-Fi in a controlled WAN role, document temporary credentials, and confirm what traffic is allowed before guests or crew rely on it.

• Confirm the marina network name with marina staff.
• Confirm whether the service uses a captive portal, vouchers, MAC registration, or device limit.
• Confirm whether credentials are personal, vessel-specific, or shared.
• Decide whether the link will carry guest traffic, crew traffic, updates, or management traffic.
• Do not connect marina Wi-Fi directly into the core switch or guest VLAN.
• Do not reuse owner, management, or vessel admin passwords on a marina captive portal.

The preferred placement is:

1. Marina Wi-Fi client or shore Wi-Fi bridge.
2. Yacht firewall WAN interface.
3. Policy-based routing or WAN failover.
4. Approved VLANs only.
5. Monitoring and logging.

Avoid connecting a marina Wi-Fi bridge to an internal switch port without firewall control. If the marina network is compromised, congested, misconfigured, or hostile, the yacht should still be protected by segmentation and policy.

Run the same short test every time:

• Confirm the firewall sees the marina link as a WAN path.
• Confirm DNS resolves through the expected resolver.
• Confirm captive portal login does not require exposing internal devices.
• Confirm guest devices receive internet only, not internal services.
• Confirm owner office VPN works only if approved.
• Confirm remote support remains disabled unless specifically approved.
• Confirm failover back to LEO, VSAT, or cellular works.
• Confirm bandwidth and latency are good enough for the intended use.

Marina Wi-Fi can expose more than expected: device names, captive-portal identities, browsing metadata, MAC addresses, and support logs. The yacht should keep guest traffic isolated, avoid sharing operational credentials, and avoid using marina Wi-Fi for sensitive owner or management traffic unless protected by approved VPN or equivalent controls.

• Log out of captive portals where practical.
• Remove temporary credentials from unmanaged devices.
• Disable temporary firewall rules.
• Restore normal WAN priority.
• Record any problems with DNS, latency, blocked ports, or captive-portal behavior.
• Update the marina notes for the next visit.