How to prevent Guest Network clients to communicate with each other?

[jeff]

And ensure that "hairpin" bridging is off. See, for example:

Clients in same WLAN can't reach each other

It might be worth checking how things are actually set in sysfs. As I understand things, there are 3 "isolation" settings... first there is an internal hostapd setting (ap_isolate=1), which should nowadays always be set on. This prevents hostapd from forwarding between wifi clients internally. Instead what it does is forward all the traffic to the br- interface and let that decide what to do with it, so that multicast-to-unicast transforms may be performed to increase common-case perform…