Dear @IanRP ,

IanRP wrote

With WiFi already part of the main LAN, I added a second network "OFFICE" to keep things like business NAS separate.

I assumed I could create an IPGROUP of my notebook and mobile devices that are on the main LAN WiFi, and allow these to access the OFFICE devices, while blocking other LAN users.

However, as far as I can tell, when defining LAN>LAN rules, I can only specify complete networks, not the IPGROUPS - which are only offered when selecting anything other than LAN>LAN.

Is there a viable option on the ER605 to permit only specific IPs to access across networks?

Did you use the router in standalone mode or controller mode?

If you have the controller, do you also have a tplink switch?

I guess you set the second VLAN interface on this router, right?

Actually you can use the Access control rule to separate the different VLAN, but can not do that on the specific IPs.

Please refer to this FAQ: https://www.tp-link.com/en/support/faq/3061/

Best Regards!

Dear @IanRP ,

IanRP wrote

@Hank21
 

IPGROUPS would be the obvious, and ideal, mechanism to tailor admin access across the networks, so forbidding it just on the LAN>LAN  makes no sense to me.

This is standalone mode. 

Does a controller mode setup change this at all ?

There is the Switch ACL you can set on the controller to achieve your needs, but you need to have a switch managed by the controller firstly.

Best Regards!