pemapon237 wrote

It seems that the "Guest" option produces a catch 22 in this use case; I can't manage my IOT devices and isolate them at the same time.

Sure you can. Just add the private IPs you want to have access to in the "Exclude subnet" field of a blocking ACL. For example, my BlockPrivNet ACL blocks access to 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8, but excludes hosts 192.168.2.5/32 and 192.168.2.15/32.

I wish TP-Link could decouple this option so that intra-VLAN blocking and private network blocking are separated.

I second this. We also need to separate between wireless client isolation and blocking of private network IPs.

Unfortunately, TP-Link did combine client isolation and blocking PrivNets into one "Guest Network" settings, but they still could have left the usere a choice to only enable "Client Isolation" and set up specific ACLs. That's how it was done in previous Controller versions. There was absolutely no reason to remove the "Client Isolation setting". Both options, "Guest Network" and "Client Isolation" could co-exist perfectly in the Controller's web UI: "Client Isolation" for power users and "Guest Network" for noobs.

@forrest, any decision from R&D about bringing back "Client Isolation" setting in Omada Controller's web UI?