At the moment I've got wrt running on a Pi3 with an extra USB-Eth adapter, which is then connected to an extra switch and wired to (currently) 2 rooms (study and TV/media-player) on the same firewall zone, with my phone via wifi on a different zone (which is how I like it)
The extra USB-Eth adapter and external 5-port switch are a bit clunky and take up a bit of room in my modem-cupboard, so what I'd like to do is replace it all with a single unit.
Ideally, I would really really like to be able to treat each room as a different firewall zone, ie keep my TV/mediaplayer/whatever (which runs god-knows-what software) on a completely different zone to my PC and never the twain shall meet (it's really easy to compromise TVs and use them as a springboard to PCs, so the only way I'm preventing this atm is to just not power them on at the same time). And for future-proofing I'd like an extra routable zone or two, maybe for a home-security/camera system, maybe for a future housemate, etc etc, without adding more devices
One option I was originally looking at is the RouterBoard RBM33G, but then a) I only get 2 wired outputs, and b) I have to buy an extra miniPCIe wifi card to get to my phone.
So I'm now looking at the hAP series.
What I'd like to know (especially from people who may have one or the other): are the wired output ports individually routable? Or are they all just switched and only able to be routed as a single zone?
Their documentation is a bit sketchy in this regard, eg https://i.mt.lv/cdn/rb_files/1556951164hAP-mini-wg-vtech.pdf says, "hAP mini and lite series ... The Ethernet ports are connected through a switch chip" which suggests one-zone and just switched (not what I want).
https://i.mt.lv/cdn/rb_files/1569483045hAP%20lite%20qg%20wnc.pdf says, "hAP lite ... Four 10/100 Ethernet ports" (which tells me nothing)
https://i.mt.lv/cdn/rb_files/1557386020hAP-qg.pdf looks a bit more promising with, "RouterBOARD hAP ... Five individual 10/100 Ethernet ports", which to me means 'individually routable', but then https://i.mt.lv/cdn/rb_files/RB951Ui-2nD-160908145004.png just says, "Integrated Switch".
So does anyone have any of these and can help me out, do any of these models have individually routable wired ports? Or are they all just switched on the same zone?
Or am I stuck buying something like a hEX and then still adding a Pi3 on top of that to provide the wifi to my phone?