Guest Wi-Fi should keep visitors away from private devices and services. Sometimes there is a good reason to make one exception, such as allowing a TV in a guest suite to reach a Jellyfin server. The safe pattern is to permit one known device to reach one server on one port, while leaving guest isolation enabled for everyone else.
This example uses Omada EAP ACLs. Menu names can vary by Controller version. A permit rule is only one part of the path: the router must also allow the routed connection, and the server must accept connections from that network.
Understand the trade-off first
An ACL exception gives the selected guest device access to the service you specify. It does not make that device trusted, and an IP-based rule depends on the device keeping its reserved address. Do not allow the whole guest subnet, all traffic to the server, or access to an administrative interface.
Jellyfin’s default HTTP port is TCP 8096. HTTP does not encrypt passwords or session tokens. Prefer a properly configured HTTPS endpoint and allow only its required TCP port. Do not expose Jellyfin’s HTTP port directly to the public internet. If HTTP is the only available option, understand that parties able to observe the path may read or alter that traffic.
1. Identify the device and reserve its address
Record the TV’s Wi-Fi MAC address and confirm it belongs to the intended device in the controller’s client list. At the DHCP server for the guest network, reserve an unused address for that MAC. Reconnect the TV or renew its lease, then verify it receives the reserved address.
Using a DHCP reservation keeps the source address stable. It does not authenticate the TV cryptographically, so keep the reservation and ACL scoped to the intended client and review them if the TV is replaced.
2. Create an IP group for the TV
In Omada Controller, open Profiles → Groups and create an IP Group containing the TV’s address as a single-host CIDR. For example, 192.0.2.25/32 represents one IPv4 address. Use the address from your own guest subnet, not this documentation example.
3. Create a destination group for Jellyfin
Create an IP-Port Group for the Jellyfin server’s single address and the specific TCP port you intend to use. For example, 198.51.100.10/32 on TCP port 8920 might represent a deliberately configured HTTPS listener. If your server uses a different HTTPS port, use that port. Use 8096 only when you have chosen to accept the HTTP security trade-off.
4. Add a narrow EAP ACL rule
Open the EAP ACL page in Omada Controller and add an enabled rule:
- Policy: Permit
- Protocol: TCP
- Source type: IP Group; select the TV group
- Destination type: IP-Port Group; select the Jellyfin server and port group
Save the rule and review the ACL table. Confirm the source group is the single TV address and the destination group is only the Jellyfin server and service port. Keep the guest network’s guest/isolation setting enabled. Avoid broad allow rules and confirm no earlier deny rule takes precedence.
An EAP ACL permit may not override a separate gateway firewall rule. If the gateway blocks traffic between the guest and server subnets, create a matching narrow gateway rule only after reviewing the gateway’s rule order and default policy.
5. Test from the TV
In the Jellyfin app, enter the server URL, such as https://<server-name>:<https-port>, and sign in. Confirm the TV can browse the library and play a short item. A successful test from a laptop does not prove the TV’s guest-network path works.
If it fails, verify the TV’s current IP and MAC in Omada, the DHCP reservation, the EAP ACL groups and rule order, gateway policy, server firewall, and Jellyfin listener. Check logs or counters where available. Test again from the TV after each focused change.
Remove the exception
Disable or delete the specific EAP ACL permit rule. Remove the DHCP reservation and its address groups if they are no longer required. Confirm the guest device can no longer reach the service and that other guest isolation still works.
The key idea is simple: preserve the guest boundary, and make any exception as small and reviewable as the service allows.