@Ethan-TP 

Hi Ethan,

thanks for your reply.

I was hoping that a business product offers this feature. Sad to hear, that this is not possible.

Is there a guide for configuring firewall rules between two subnets (VLANs) on a port base?

I want to allow all devices in my IoT VLAN to access my Home Server on port 1883. 

I also want to allow the IoT devices to reply to requests from a certain VLAN, but block traffic initiated from the IoT VLAN to other VLANs in my network.

I configured a IP-Port-Group for my Home Server:

Than I created 2 Gateway ACLs:

But after activating the deny rule the IoT devices could connect to the server via MQTT (1883).

Couldn't figure out, whats wrong here.

Regards,

tukane