Issue on isolating clients in wired guest network

[lleachii]

@madmat17

My thinking was that the firewall / nftables rules applied to VLAN 3 should then be defined in the context of the zone lan_guest.

Correct. And everything you described looks good. Except...

@madmat17

All clients (no matter if connected via ethernet or wirelessly, no matter via which router) within the VLAN 3 should be isolated from each other.

This is not possible. The Router 1 OpenWrt device does not manage the Layer 2 MAC tables/filtering/etc. of:

• Ground Floor Switch
• Basement Switch

So it's impossible that (in general) any device on your VLAN 3 could be isolated in another location in your home by Router 1. Save VLANing more.