@Defty 
 

It sounds like you've set up your network correctly, but the gateway ACLs aren't working as expected. Here are a few things to check:

1. ACL Placement – Ensure that the ACLs are applied to the correct interfaces (LAN or VLAN) and are processed in the right order. Some gateways apply ACLs differently depending on inbound/outbound traffic.

2. Management VLAN – If your switches and gateway are using the same VLAN for management, it’s possible that traffic is bypassing the ACLs. Try moving management to a separate VLAN and see if that helps.

3. Easy Managed Switch – Some smart switches handle VLANs differently. If the ES205G is not fully VLAN-aware, it might be forwarding traffic in a way that bypasses ACLs.

4. Firewall/NAT Rules – Check if there are existing firewall or NAT rules on the ER707-M2 that could be overriding your ACLs. Sometimes, default rules allow all traffic unless explicitly blocked.

5. Testing Approach – Since switch ACLs work but gateway ACLs do not, try enabling logging on the ACLs (if available) to see if they are even being hit. Also, testing with different VLANs might help identify if the issue is VLAN-related.

Since you need stateful ACLs, you may need to look into the router’s firewall settings instead of just ACLs. Let me know if any of this helps!

  @Saleem_Al_Shera 

Thanks for the reply.

1. yes checked and triple checked

2.Management vlan is on a separate vlan (10.10.10.50 ) are you suggesting to palce MGMt vlan separate from devices?  I dont see how this would function.

3.No vlans intended for stateful ACL are on easy managed switch.  I have also dissconnect the switch to elimate this but in controller i still have the check box ticked that says im using easy manged switches.

4. Will look into this.  As im new, is there anything in particular i should be looking for?

5. having difficulty with the logging procedure on controller, but will look further.  have extensivly tested with different vlans with no success.

Please do have a wee look at the guide i used from Tp link for initial config.

thanks for posting :)

Hi @Defty 

Who is the DHCP server, or who hosts the DHCP, it should be set up with the ACL.

If you are using a VLAN interface, you set up the Gateway ACL. You use Switch as the DHCP, you set up the Switch ACL.

 Hi  @Clive_A 

As I require the use of statefull ACL's I did indeed set the DHCP host on the Gateway interface.

I'm aware that stateful ACL's can only be configured on the gateway.

So, with all protocols selected:

Network Interface (A) 10.10.100.1/24 ---> deny--->10.10.200.1/24 (B)  

Is it expected behaviour that I can ping the gateway of interface of B when connected to a Lan port assigned with A?

Thanks for you time.

  Great, simple and effective explaination thankyou @Clive_A