Choosing a router for a small office or storefront

The short version

• The job changes from "Wi-Fi everywhere" to "separation and uptime". A shop needs guests, staff devices, card terminals and cameras on separate networks, a backup internet line that takes over without anyone touching it, and an admin login the business owns.
• Separation needs VLANs end to end. The router, access points and every switch must carry them; an unmanaged switch or a Wi-Fi-only guest network leaves wired devices together. Several vendors also leave isolation off until you turn it on.
• Failover keeps the shop online, but it doesn't keep calls up. Connections that move to the backup line come from a different public address and have to reconnect. Make the backup a different technology, and put the network on backup power.
• The shortlist is wired gateways plus access points. Of the 22 current gateways in our catalog, 21 document VLANs, but only 7 are also recorded with management that doesn't need a cloud account. Two shortlists below, split at $300, add failover ports, PoE and IDS/IPS figures.
• Payment rules: the PCI Security Standards Council calls segmentation "not a PCI DSS requirement" but strongly recommends it, and says a flat network puts everything in scope. This article isn't compliance advice. Your acquirer or payment provider decides what you have to validate.

The requirements checklist, mapped to catalog fields

The RouterHaus catalog (published in full at /data, checked October 20, 2026) records some requirements as fields and others only in product notes. The last column is what you still have to check.

Two catalog counts (current models, catalog checked October 20, 2026):

• Gateways (no built-in Wi-Fi): 21 of the 22 document VLANs. Only 7 of those 21 also have localManagement recorded as documented: three from Netgate, two ASUS ExpertWiFi and two TP-Link Omada. For the nine Ubiquiti and five Firewalla gateways the catalog leaves it unknown (Ubiquiti documents local sign-in but not account-free setup; Firewalla requires its app). 15 of the 22 publish an IDS/IPS throughput figure.
• Wi-Fi routers: 16 of the 58 document VLANs, and 12 document VLANs and local management together: five MikroTik, four ASUS, two Synology and one GL.iNet.

That's why the shortlists are gateways. An all-in-one router can serve one small room; a shop with a back office, sales floor and cameras usually needs a gateway, a PoE switch and ceiling access points (see mesh vs a router plus access points). Our coverage rule (about 1,000 sq ft per access point behind block, brick or stucco) applies to shops too.

Keeping guests and card terminals apart

What the payment-card industry's standards body says (documents read October 29, 2026):

• Segmentation is recommended, not required. The PCI Security Standards Council's scoping guidance says isolating the cardholder data environment (CDE) "is not a PCI DSS requirement", but it is "strongly recommended" because it may reduce an assessment's scope and cost. "In a flat network, all systems are in scope if any single system stores, processes, or transmits account data."
• Separate segments aren't automatically segmentation. "The existence of separate network segments alone does not automatically create PCI DSS segmentation." The guidance calls for "purpose-built controls" and gives firewall and router configurations as common examples.
• Guest Wi-Fi gets its own network. The Council's guide for small merchants: "If your shop offers free Wi-Fi for your customers, make sure you use another network for your payment system (this is called 'network segmentation')."
• Wireless sits behind a control. In the SAQ D self-assessment questionnaire for merchants, requirement 1.3.3 says network security controls are installed "between all wireless networks and the CDE", with wireless traffic into the CDE "denied by default". Where segmentation is used, requirement 11.4.5 calls for penetration tests of the segmentation controls at least once every 12 months and after changes. (Quoted from the v4.0 questionnaire; the Council's document library lists v4.0.1, October 2024, as the current version.)

The scoping guidance says it "does not address PCI DSS compliance" and sends merchants to their acquirer (merchant bank) or the card brands. Which questionnaire applies, if any, depends on how your terminals connect; ask your payment provider before you design around a requirement.

How each vendor documents separation

From each vendor's support documentation, checked October 29, 2026.

Three practical rules follow:

1. Check isolation is actually on. From a guest device, try to ping another guest device (TP-Link's own check), a staff PC and the router's login page. All three should fail.
2. Mind client isolation. On eero's IoT network a camera can't reach a recorder on the same network. Decide where the recorder lives first.
3. Keep smart speakers and screen-sharing TVs with the phones that control them (see our Apple Home and Matter guide): usually the staff network.

More depth: our eero, ASUS and UniFi comparison and work-from-home network security.

Failover: what a second line can and can't do

In failover, one line carries everything and the other waits; in load balancing, new connections are spread across both. Vendor documentation, checked October 29, 2026:

• Calls and VPN tunnels reconnect; they don't carry on. A connection that moves to the other line arrives from a different public address, and Netgate warns that some sites, "banks and other security-minded sites", break when a client's address changes between connections. Expect a dropped call or a re-login.
• The backup should fail differently: not the same provider or the same cable into the building. Cellular or fixed wireless usually is. Catalog options: a USB modem on the ASUS ExpertWiFi and Omada gateways, a built-in 5G modem on the UniFi Dream Router 5G Max (certified with AT&T and T-Mobile; Verizon wasn't supported when the catalog checked), or a provider's own gateway on an Ethernet WAN port.
• The backup line may not accept incoming connections. T-Mobile says its home internet gateways "do not have the ability to enable and disable NAT/port forwarding", and Starlink's default carrier-grade NAT policy "does not allow inbound traffic", so a VPN server reached from outside may stop working during a failover. See CGNAT explained.
• Avoid double NAT on the main line. If your provider installed a gateway, use bridge mode or IP passthrough so your router gets the public address; see bridge mode vs IP passthrough.

Sizing PoE for access points and cameras

RouterHaus's planner counts PoE the way switches allocate it, by class: 15.4 W per 802.3af (Class 3) port, 30 W per 802.3at (PoE+) port, 60 W per 802.3bt Type 3 port, with cameras assumed to be Class 3 (see methodology). A typical storefront, as arithmetic: two PoE+ ceiling access points (2 × 30 W = 60 W) and four Class 3 cameras (4 × 15.4 W = 61.6 W) need 121.6 W. Against the budgets the makers publish:

Counting by class is deliberately cautious: a switch that allocates by measured draw may power more, but makers rarely say which way theirs works. See also PoE budgets for access points.

Supportability: who can fix it on a Saturday

• Own the admin login. The business, not the installer or one employee, should hold it. The catalog records one administrator account for ASUS's ExpertWiFi gateways. On eero, transferring the network to a new owner ends eero Business and its extra networks.
• Local access during an outage. Ubiquiti's local-management guide covers managing UniFi from a browser or the UniFi app on the local network "for instances when users experience an Internet outage", with a default username of admin for local-only deployments. pfSense and ASUS ExpertWiFi have local web interfaces. Omada gateways have a standalone web interface (the app and cloud access need an Omada controller). Firewalla needs its app.
• Who answers the phone. Internet providers generally support only the equipment they supply (see our guide to owning your network), so you rely on the maker. Netgate includes TAC Lite support and sells paid tiers (per the catalog). For update policies, see how long eero, ASUS and Ubiquiti support their gear.
• Write it down. A one-page record of VLANs, ports, Wi-Fi names and the failover setup lets someone else take over, and is a starting point for the network diagram that SAQ D requirement 1.2.3 asks merchants to keep accurate, showing all connections between the CDE and other networks, including wireless ones.

Gateways at $300 or less

The rule for both tables: every current catalog gateway that documents VLANs and is recorded with two or more ports usable as WAN, in its port list or notes ("up to 4 WAN"). This one takes catalog prices of $300 or less, with Ubiquiti's US store surcharge included as the table shows it. Left out: the TP-Link Omada ER605 (three WAN ports, but no published price), the UniFi Gateway Lite and Firewalla Purple SE (one WAN), and the Netgate 1100, whose third port is labeled OPT but for which the catalog records no multi-WAN.

Gateways over $300

Same rule, catalog price above $300: multi-gig ports, rack mounting, bigger PoE budgets or higher IDS/IPS figures.

Ports labeled WAN/LAN count as internet ports in the catalog, so "Fastest LAN port" can understate a model: the ER707-M2's second 2.5 Gbps port is WAN/LAN. Netgate's 2.2 Gbps figure for the 2100 is an L3 forwarding test (iPerf3) on a gateway whose ports are all 1 Gbps, so it isn't one connection's speed; Netgate doesn't say how ports or directions were combined. What the tables don't show, from the catalog:

Compare the IDS/IPS column with your plan speed: our planner rules a setup out when you ask for IDS/IPS and the published figure is more than 10% below your plan. Firewalla defines its figure as full IDS/IPS with three regions blocked and a 1,000-entry rule; Ubiquiti and TP-Link state no conditions. Ubiquiti's optional CyberSecure (Proofpoint threat signatures) is from $99 per unit, billed annually, on its US store (checked October 29, 2026). For other add-ons, see router subscriptions compared; for choosing among Ubiquiti's gateways, see which UniFi gateway fits.

Which kind of setup fits which business

Still choosing a kind of equipment? Start with our router buying guide; for cabling and a back-office rack, see what goes in a network closet.