Hi @Cheapsk8 

Thanks for posting in our business forum.

I am not sure why you add an IoT gateway. Is there a reason for that? If you want, so be it. You should worry about if the VLAN can be effective since you are literally separating this VLAN 3 from the whole Omada network. Different Gateway means the NAT is not done by the Omada gateway. Configs and all other things will be done on that router.

VLAN 3 has to be configured on the IoT gateway. You cannot use ER605 for the creation of the VLAN 3. It's not gonna work because of NAT on the IoT gateway.

And your IoT gateway LAN should connect to the switch with the VLAN 3.

The Omada router is capable of ACL which you can use it for allow and deny. If you still keep Omada as the gateway, you can use the ACL.

Hi @Cheapsk8

OK. Then you are referring to a product like an IoT controller. Not the Gateway(router) we usually say. Then it should be a lot easier. You don't have to change your plan or diagram if that's an IoT controller.

All you need to do is to refer to the setup guide to set up your VLAN interfaces and implement ACL to segregate the IoT.

Standalone guide How to create multi networks and manage network behavior with ACL on Omada Gateway in standalone mode

Controller guide How to configure Multi-Networks & Multi-SSIDs on Omada SDN Controller

Hi @Cheapsk8 

Your picture was posted with a managed switch so I thought that you were an owner of a full Omada solution. Omada router, Omada switch(all manageable), and EAP.

If the switch is unmanaged, then you cannot implement what you need because you need to specify the ports on the switch with different VLAN IDs. Each port may contain one or more than one VLAN ID.

With an unmanaged switch, you cannot specify anything but plug-and-play. And all VLANs will flood into the port if you trunk the downlink of the router.

There isn't any better way to fix this. Unless you have multiple unmanaged switches, so for each switch it will have a dedicated VLAN. Because an unmanaged switch can only handle one untagged network and this does not fit your setup because you need some other devices to work on the switch.

If the setup isn't suitable for you and exceeds your budget, you can consider another solution. If you need to get a managed switch, and stick to this plan, you have to keep the Omada router. Get a managed switch from the Omada series, or any other VLAN-supported and configurable switch and implement this.