Oh I see. Am I correct to assume that if someone has a sub-router or sub-switch that needs segregation of guest vs non-guest ports: i.e. two sub-switch ports on guest LAN and two sub-switch ports on non-guest LAN, then better go with the VLAN tag method because it allows both guest and non-guest "stream" on the same cable.
Correct. VLANs allow you to carry multiple networks over a single cable to the next device. Then a VLAN aware AP and/or a managed switch enables those networks to be accessed as needed via wifi (usually one SSID per network; possible to make a single SSID with unique passwords to direct to different VLANs) or per-port on an ethernet switch.
That would happen if you have masquerade enabled on the lan zone. If you are adding a guest network to a basic lan->wan main router, masquerade should not be enabled on any guest or lan zone, only on wan. Then symmetric routing (source IP address preserved) will occur between the LANs.
