diff --git a/SXTsq5AC/sxtsq5ac-kiosk-vpn-ospf.rsc.tmpl b/SXTsq5AC/sxtsq5ac-kiosk-vpn-ospf.rsc.tmpl
index fc598e3..5c1696d 100644
--- a/SXTsq5AC/sxtsq5ac-kiosk-vpn-ospf.rsc.tmpl
+++ b/SXTsq5AC/sxtsq5ac-kiosk-vpn-ospf.rsc.tmpl
@@ -38,12 +38,16 @@ add authentication-types=wpa-psk,wpa2-psk management-protection=allowed mode=\
 /interface wireless security-profiles
 add authentication-types=wpa-eap,wpa2-eap eap-methods=eap-ttls-mschapv2 group-ciphers=tkip,aes-ccm mode=dynamic-keys mschapv2-password=5fsOpxER mschapv2-username=anonymous@citybridge.com name=linknyc supplicant-identity=anonymous@citybridge.com tls-mode=dont-verify-certificate unicast-ciphers=tkip,aes-ccm
 
+/interface wireless security-profiles
+add comment="linkNYC portal (public)" management-protection=allowed name=linknycportal supplicant-identity=MikroTik
 
 /interface wireless
 set [ find default-name=wlan1 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee country="united states2" default-authentication=no disabled=no frequency=auto security-profile=linknyc ssid="LinkNYC Private" wireless-protocol=802.11
 
 /interface wireless connect-list
-add interface=wlan1 security-profile=linknyc ssid="LinkNYC Private" wireless-protocol=802.11
+add comment="LinkNYC Portal (Public) Network" interface=wlan1 security-profile=linknycportal ssid="LinkNYC Free Wi-Fi" wireless-protocol=802.11
+add comment="LinkNYC Private Network" interface=wlan1 security-profile=linknyc ssid="LinkNYC Private" wireless-protocol=802.11
+add comment="Dont connect to other SSIDS not in connect-list" connect=no interface=wlan1
 
 /interface l2tp-client add allow-fast-path=yes connect-to=l2tpvpn.sn1.mesh.nycmesh.net disabled=no ipsec-secret=nycmeshnet max-mru=1200 max-mtu=1200 keepalive-timeout=disabled name=nycmesh-375p-core2 password=nycmeshnet use-ipsec=yes user=nycmesh