A vessel Wi-Fi that mixes charter guests, crew and operations traffic on a single flat network is a bad design that most Singapore yacht and charter operators have inherited from earlier installers. It’s slow when the charter clients start streaming, insecure because guests can see ops systems, and impossible to troubleshoot when something goes wrong. This post covers the right Wi-Fi VLAN design for a mid-size charter vessel and how to configure it on a Peplink router.
Why VLANs matter on a vessel
A VLAN (Virtual LAN) is a logical network segment. Even if all devices connect to the same physical router, they can be isolated into different broadcast domains. Benefits:
- Bandwidth control — cap the charter clients at 40 Mbps so crew and ops always have breathing room
- Security isolation — guest devices cannot see ECDIS, engine telemetry, or crew laptops
- QoS priority — bridge traffic (chart updates, weather, safety) gets guaranteed priority over crew Netflix
- Fault isolation — one guest device with a virus doesn’t take down the whole vessel network
- Compliance — required for IMO 2021 cyber compliance and enterprise charter contracts
The four-VLAN design for a charter vessel
| VLAN | Purpose | SSID (visible name) | Bandwidth cap | Isolation |
|---|---|---|---|---|
| VLAN 10 — Ops | Bridge, ECDIS, engine, security cameras | Not broadcast (hidden) | Unlimited priority | Fully isolated from all others |
| VLAN 20 — Crew | Crew personal devices, off-duty | “Vessel-Crew” | Per user cap (5 Mbps) | No ops access, no guest visibility |
| VLAN 30 — Guest | Charter clients, visitors | “Vessel-Guest” | Aggregate cap (40 Mbps) | Internet only; no local network access |
| VLAN 40 — Management | Router config, IoT sensors | Not broadcast | Uncapped | Only accessible from Ops network |
Physical layout — where to put access points
For a 25-30m charter yacht:
- Bridge — one AP for Ops VLAN. Peplink AP One AC Mini or similar (weatherproof if exposed).
- Main saloon — one AP broadcasting both Crew and Guest SSIDs. Ceiling-mounted.
- Guest cabins — one AP per 2-3 cabins depending on vessel layout. Wall-mounted.
- Aft deck — one weatherproof outdoor AP for guest connectivity when guests are outside.
All APs connect back to the Peplink router via wired Ethernet. Mesh backhaul is an option but wired is faster and more reliable on a metal vessel.
Peplink configuration steps
On a Peplink B One or MAX Transit Duo:
- In InControl 2 or the local admin UI, go to Network → LAN → Network Settings
- Create VLAN 10 (Ops), VLAN 20 (Crew), VLAN 30 (Guest), VLAN 40 (Management). Assign each a distinct subnet (e.g. 192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24, 192.168.40.0/24).
- Under AP Controller → SSID Configuration, create SSIDs for Crew and Guest. Bind each to its respective VLAN. Ops SSID is optional; if used, keep hidden (do not broadcast).
- Under Firewall → Local Firewall, add rules:
- Deny VLAN 30 (Guest) → any other VLAN
- Deny VLAN 20 (Crew) → VLAN 10 (Ops) or VLAN 40 (Management)
- Deny VLAN 10 (Ops) → VLAN 30 (Guest)
- Under QoS, set VLAN 10 to Highest priority, VLAN 40 to High, VLAN 20 to Medium, VLAN 30 to Low.
- Under Bandwidth Control, cap VLAN 30 aggregate at 40 Mbps down / 10 Mbps up. Cap VLAN 20 per-client at 5 Mbps down / 2 Mbps up.
Want a practical view of what your fleet really needs?
Share your fleet size and the problem you are trying to solve. We will suggest a sensible starting point, not a shopping list.
What it costs to deploy
| Item | Cost (SGD) |
|---|---|
| Peplink AP One AC Mini (x3-5 depending on vessel) | 800-1,400 (each) |
| Weatherproof outdoor AP for aft deck | 600-900 |
| Ethernet cabling and PoE injectors | 500-1,200 |
| Install labour (rigger + IT engineer) | 1,800-2,500 |
| Configuration and testing | 800-1,200 |
| Total for a 25-30m charter yacht | 6,500-10,000 |
Charter revenue impact
Charter guests will pay more for a vessel with reliable Wi-Fi and dedicated guest bandwidth. Anecdotal but real: Singapore charter operators who upgrade from flat network to properly-segmented setup report:
- Guest satisfaction scores up 15-25%
- Fewer complaint refunds and rebooking issues
- Ability to command 5-10% premium on weekly charter rate for well-connected yachts
Related reading
- Peplink B One vs MAX Transit Duo
- Bonded Starlink + OneWeb + Peplink guide
- Maritime cybersecurity guide
Get a vessel Wi-Fi quote
Tell us the vessel LOA and typical guest/crew count — we will design and quote a proper VLAN-segmented Wi-Fi installation. Install at any Singapore marina. Sales at Envisiondata Pte Ltd — sales@envisiondatasg.com — or WhatsApp Steve directly on +65 9088 4899.
How we can help
Fleet technology only pays back when it is sized to the job and set up properly. We help operators pick the right systems, install them and keep them working.
- Free fleet systems assessment
- Onboard network, Wi-Fi and cybersecurity design
- Fuel monitoring and fleet IoT with shore dashboards
- Pilot projects on one to five vessels before full roll-out
What happens when you contact us
- Short call or meeting — we listen to how your vessels operate.
- Vessel and route review — we check equipment, space, power, contracts and licensing.
- Clear recommendation — a written proposal and SGD quote, with options.
- Install and support — commissioning, testing and ongoing support.
Related: Fleet Manager bundle
Book a free fleet systems assessment
There is no obligation. If your current set-up is already the right one, we will tell you.
About the author
Steve leads Envisiondata Pte Ltd in Singapore. He has more than 20 years in cables, telecom infrastructure and satellite communications across ASEAN. He designs and supports connectivity for tugs, OSVs, harbour craft and commercial fleets across the region.
Written by Steve
Steve has over 20 years of experience in cables, telecom infrastructure and satellite communications across ASEAN. He founded Envision Data to help Singapore and SE Asia vessel operators choose and run the right maritime connectivity, from Starlink and OneWeb to Iridium, Inmarsat and GMDSS.
Leave a Reply