@GRL 

Hi,  thanks for your reply. 
 

Ahh ok, being a little new to this setup, from what you are saying, if everything is though the same switch, a switch ACL will work for this?

I currently have the ER8411, with a SG2016P, and 2x

SG2008P attached to ports on the ER8411. My Home Assistant NUC is also attached to a port in the ER8411 (just as it's physically close to it!). The Gateway ACL doesn't seem to have any affect. But are you saying that if the Home Assiatant NUC is on a port on the SG2016P the switch ACL should work? (Or if I was to get another SG2008 plugged into a port in the ER8411, as my 2016 is full)

am I causing issues using the LAN ports on the ER8411, should I just use that for WAN and downlinks to the switches?

Many thanks again,

Cheers

Gary

  @gskips 

Your switches support Switch ACL, that is definitely the way to go for the rules you want

Remember ACL rules work top down in a "first match wins" so you want the allow rule above the rules that block.

Also note switch rules are not stateful so you will have to inherently have an allow rule for both directions

  @GRL 

Great, thank you!

so I should remove anything other than switches from my ER8411, and then use switch ACLs, which should now work?

And just to confirm, good practice is just to use the ports in the ER8411 as downlinks to any switches I have on the network and not other devices?

thanks

  @gskips 

Switch rules can only work on traffic that goes through them.  In general most networks will have a central switch and everything spreads out from that.  Its not a requirement, but it tends to be the default design for good reason