R1D2 wrote

See this recipe: https://forum.tp-link.com/showthread.php?99022-How-to-configure-Multiple-SSIDs-work-with-Multiple-VLANs-based-on-EAP-products

In short: you need either Multi-Nets-NAT or a VLAN-aware router with the capability to define two separate networks.

I kinda figured that's what might be going on. I need a deeper understanding of whats going on with VLANS. I was going to use Wireshark to monitor the frames and do a deeper inspection of the frames, but it dawned on me that not having internet provided by the gateway on the 2nd VLAN probably means that there was an issue occurring at the routing level. It just confused me that the clients that attempted to connect to the guest network on VLAN 2 where able to receive an IP from the DHCP server within the router but could not connect through the gateway. Also I was under the impression that since the VLAN 2 guest network would be using the same subnet from the only DHCP server in the whole network and setting the switch port that the router is connected to, to "Untagged", that the tag would be removed from the header and the frames would be able to pass through the gateway normally. Guess that's not the case, and I need a deeper understanding of VLANs.

I was provided by TPLink support with a link to a FAQ explaining how to do this with the EAP Controller Software by setting an ACL rule for the SSID I wanted to setup as a guest network. Really didn't want to go that path considering this is only 1 EAP and will be the only one. Just seems like over kill to me. You would think that as large as the EAPs are, that the boards in them would be able to support enough flash space to run some these features and provide a CLI command list to enforce an ACL policy embedded within the unit.