Firewalls and Law 5651 logging for hotels: choosing and setting up the box

A 5651 logging device is a box that does three jobs at once: it firewalls the guest network, it identifies each guest at login, and it stores access records. Under the Regulation on Internet Collective Use Providers (mevzuat.gov.tr, consolidated text) (opens in a new tab), Article 4, those records must be saved electronically and kept for two years.

A supplier quotes a hotel firewall with the law's number printed on the label. It arrives, it goes on the wall, the guest Wi-Fi works, and nobody in the building can say what it records, for how long, or who is allowed to read it. That gap is what this guide closes. After reading it you will be able to read a quote line by line, ask the questions that expose a weak box, and check an installed system before you sign it off.

What does a 5651 logging device actually do?#

It does three separate jobs: it guards the network as a firewall, it asks each guest to identify themselves before the internet opens, and it writes and stores the access records. Vendors bundle the three, but they fail separately.

The firewall decides which traffic may pass between the guest network, the staff network and the internet. It protects and filters; on its own it does not record who did what. The guest login, also called a captive portal or hotspot, intercepts the first web request from a device, shows a page, collects an identifier and opens a session. This is where identification happens. The log store keeps the record of each session: the address handed out, the device, the start and end times and where the traffic went. It needs storage, a time source and access control.

The bundle matters because the cheap version of each part is invisible. A firewall with no storage passes traffic and keeps nothing; a hotspot without a firewall exposes the staff network; a log store with a drifting clock produces records nobody can match to anything.

Ask one question of every quote: which of the three does this box do, and where does each part keep its data. A supplier who cannot answer in one page has not understood the job.

What does the law actually ask a hotel to keep?#

Article 4 of the Regulation on Internet Collective Use Providers requires providers within its scope to filter content, to save access records electronically on their own systems and to keep them for two years, and to identify users by SMS or a similar method where internet is offered in public areas.

The regulation was issued by the BTK under Law No. 5651 and published in the Resmî Gazete on 11 April 2017 (No. 30035). It replaced the 2007 text, and the consolidated version on mevzuat.gov.tr shows no amendments since. Article 3 defines the record itself: the internal IP addresses handed out, the start and end times of use, the MAC address of the device using that address, the destination IP address and, where one or more addresses are shared among users through ports, the real IP and port assigned to the user.

Article 5 adds duties for commercial-purpose providers: a permit from the local civil administrator, a fixed IP reported within fifteen days of any change, content filtering kept active and up to date, and a value recorded daily that confirms the accuracy, integrity and confidentiality of the records, kept with them for two years. Article 3 defines those commercial-purpose providers as internet salons and similar places open to the public. The regulation does not name hotels, so the first task is to establish with a lawyer which duties apply to your property and in what form.

One more layer: recent legislative changes moved these duties and powers from the BTK to the Cyber Security Presidency. Until the Presidency issues new secondary rules, the existing regulations continue to apply, and references to the BTK in them count as references to the Presidency. Confirm the current consolidated text in the Official Gazette, and check the transfer and its secondary rules with a legal adviser. Read the full legal picture in our companion piece on guest Wi-Fi, login and logs under Law 5651 before you read a single quote.

How do you size the box: by rooms or by devices online at once?#

By devices online at the same time. The same hotel in low season and on a full Saturday puts very different loads on the box, and the box has to be sized for the second case.

Count concurrency, not rooms. One occupied room can hold three or four connected devices: phones, a laptop, a tablet, a smart TV. Add staff handsets and back-office machines. Three limits are separate and all three must be quoted: throughput in megabits per second, the number of sessions the box can track at once, and how many new sessions it can open per second when guests come back from dinner together.

Log volume follows sessions, not guests. Each session writes a record, so storage is records per day multiplied by record size multiplied by the retention period, plus index and backup space. Address handling matters too. A short lease recycles addresses and writes more records; a long lease keeps the mapping stable but can exhaust the pool. When many guests share one public address, the port becomes the only way to tell them apart, which is exactly the case Article 3 anticipates. Ask for the number at the peak hour in writing, not the marketing maximum on the datasheet.

For the line that feeds the box, see our guide on sizing hotel bandwidth from rooms, guests and peak hours.

Which guest login method should the hotel use, and what does each one record?#

Each login method records a different identifier, so the choice is a trade between guest friction and the quality of the record you can produce later.

An SMS code ties the session to a phone number the guest had to receive a message on. It is the strongest identifier and the most friction, and it needs a messaging provider and a per-message cost. A voucher or printed code handed out at reception ties the session to whoever received the code, which is only as good as the reception log behind it. Room number plus surname is quick at the desk, but the record proves a room was used, not who used it, and surnames repeat inside one hotel.

A click-through portal with no identifier is the least friction and the weakest record: it proves a device connected, nothing more. It suits a lobby or a café area, not a place where identification is expected. An email or social account login records an account and adds a third party to the flow, which brings its own data-protection question and should be reviewed before it is switched on.

Whichever method is chosen, the login page should say what is collected and why, and the session record must still carry the Article 3 fields regardless of how the guest signed in.

How should records be time-stamped, stored and read?#

Records are only useful if they carry a trustworthy time, survive a reboot, and can be read by the people entitled to read them and by nobody else.

Time first: point the firewall, the wireless controller and the log store at one network time source and one time zone. A record with a drifting clock cannot be matched to anything, including another record from the same box. For integrity, Article 5's daily value confirming accuracy, integrity and confidentiality is the pattern to ask for. In practice that means a hash chain or a signed daily digest that shows whether a record was altered after it was written.

On storage, keep a local copy plus an export. If the records live only in a vendor's cloud, ask who owns them, how they come back, and what happens to them when the contract ends. Retention is two years under Article 4 for providers within scope, so plan disk and backup for the full period, not for the current month. On access, use named accounts instead of one shared administrator password, write a rule on who may query records and for what reason, and keep a query log so the queries themselves are visible. On export, demand a plain readable format carrying the Article 3 fields, so a request can be answered in an hour without calling the supplier.

Can one box keep the guest network and the staff network apart?#

Yes, if the box is configured with separate zones rather than separate Wi-Fi names. A second network name on the same flat network hides the problem instead of solving it.

Split the network into zones: guest, staff, management and devices. Management means the property system, payment terminals, cameras and door locks; devices means televisions and sensors. Write the rules between zones explicitly: guest to internet only, staff to the property system and internet, management reachable from nowhere inbound, devices to their own controller.

The split protects the records as well as the hotel. If staff phones sit on the guest network, their traffic lands in the guest records and the record becomes ambiguous exactly when someone asks about it. Payment terminals and the property management system belong on their own segment: card data and guest records should not share a broadcast domain with guest phones. Turn on guest-to-guest isolation at the access point; it stops one guest device reaching another and removes a common source of complaints. The hotel firewall is where the rules live; the access points only carry the tags. A supplier who proposes separate network names with no zone rules has not done the job.

For the full design, see our article on separating guests, staff, payments and devices in a hotel network.

What happens when the box fails?#

Guest internet may keep running or stop entirely, but the logging duty does not pause for a repair, so the failure has to be planned before it happens.

Know the failure modes: a dead power supply, a full disk, a firmware update gone wrong, an expired licence, an upstream line outage. Each one looks different to the guest and to the record. A full disk is the quiet failure. The box keeps routing traffic and stops writing records, so the network looks healthy while the record has a hole in it. Set an alert well before the disk fills and a retention rule that removes the oldest records only after the required period.

Ask for a spare or a support contract with a stated response time, and ask what the supplier actually does at 23:00 on a Saturday. A warranty that ships a replacement in five working days is not a plan. Write down the fallback: what reception does when the login page is down, who decides whether to open the network without identification, and how that decision is recorded. Test the restore: a configuration backup that has never been loaded onto a spare box is a hope, not a backup.

For the line behind the box, see our guide to choosing a hotel internet line.

What to do next#

Write a one-page requirements list from Articles 3 and 4, send it to two suppliers, and ask each to answer it in writing: peak concurrent devices and sessions, storage for the full retention period, the time source, the daily integrity value, the export format, who may read the records, and what happens when the disk fills or the box dies. Then have a lawyer confirm which of the regulation's duties apply to your property. The firewall, the guest login and the log store are one purchase but three promises, and only a written answer shows which of them the box actually keeps.