@PeterHer 

How are you setting up the vlan ports?

If you want devices over wifi from the EAP to connect to different vlans based on tagging, you must include each vlan on the port its connected to on the 7206 in tagged mode and set the eap to insert the tags

  @GRL 

Thanks for your reply.

I only want wired devices port 3 of ER7206 connected to TL-SG1024 (192.168.0.100 - 192.168.0.199)

to be separated from the WiFi devices port 5 of ER7206 connected to EAP225 (192.168.10.100 - 192.168.10.199).

Both vlans should be able to connect to the internet. No connection between the two vlans are necessary.

  @PeterHer 

Then you need to set up 1 (or two if you want) Access Control Lists

Rule 1 - Block / LAN>LAN / Protect_From_VLAN / Destination_VLAN

Rule 2 - Block / LAN>LAN / Destination_VLAN / Protect_From_VLAN

I always like to set rules both ways

Note that the gateway IP (of the 7206) on any vlan is always accessible from any other vlan, which is a bug reported multiple times

  @GRL 

> Note that the gateway IP (of the 7206) on any vlan is always accessible from any other vlan, which is a bug reported multiple times

Godd*mn it! Is that why I can't get ACL to work on my ER7206 V1? It's still not working in firmware version 1.2.3 in 2023?

My post