@jim2cpu 

You are right. If you only have Omada Gateway, then you can not do LAN-to-LAN access control with the IP group you created. There are only default "Network" IP groups.

Hope there will be an update in future, but for now you may still need to add an Omada switch to your network.

  @KJK 

KJK wrote

  @jim2cpu 

 

If you want to use IP Groups, the Direction needs to be ALL. With IP Groups and a proper Service Type (possibly custom), you may be able to set up an ACL that will do the job, but I'm not sure. I haven’t done it myself since I do not use my ER7206 for inter-VLAN routing.

Thank you for the replies. ALL isn't an option when setting the direction on a Gateway ACL, it seems.

I may need an Omada switch to apply this at the Switch ACL level but would be open to trying any other ideas.

Not a deal breaker but a minor inconvenience.

KJK wrote

  @jim2cpu 

 

Try the ‘standalone’ with the router if you can. I think it would be a valuable experience even if it does not work. You can always go back to Omada Controller. That should be easy with proper configuration backups.

  @KJK 

I don't think I'm going to try it in standalone mode given the family impacts of any network change. With a very connected household with two teenagers gaming and TikToking 24/7/365, I need to pick my spots. :-)

I think I'll wait to see how the controller advances in the months ahead, not to mention additional firmware releases for the ER7206.

... and I'm still willing to try other configurations with what's available today to see if I can make this use case work.

Cheers.