How to prevent Guest Network clients to communicate with each other?

My DIR-860L is ready to go but i dont get it done with the isolated guest AP@ OpenWRT (wired+wifi) :frowning:
First of all i followed this tut and disabled the firewall: https://wiki.openwrt.org/doc/recipes/dumbap
My WRT3200: 192.168.1.1, Guest Interface 192.168.55.1
DIR-860L: 192.168.1.3, Guest Interface: 192.168.55.2 (do i even need the second guest interace @the DIR-860L

VLAN config WRT:
vlan_wrt

VLAN config DIR-860L:
860L_vlan

I do get an IP of my normal LAN subnet at any port of the DIR-860L
If i set Lan1-4 off (VLAN1) i'm not able to recieve an IP adress anymore (im testing with a wired client atm)...
I'm a bit lost....

edit: i got it done, with the following switch config@860L...
860L_vlan_fixed

My Wifi AP's are also set up but isolation between wired and wifi clients doesn't seem to work again.
I guess for the ebtables "-A FORWARD --logical-in br-guest -j DROP" command i need the firewall UP and running, is that correct ?

So how do i enable Isolation between my wired and wireless guest clients @ the DIR-860L?
nvm: i need to install ebtables first, i am silly billy again...