But, what does one do if they've already adopted the ER605 to the Omada Software Controller? You can't change the PVIDs there. Also, why do the VLANs have to be tied to separate ports? Why can't I just use a trunk link to a managed switched and not have to worry about the devices in the separate VLANs seeing each other? I also tried every variation of setting Gateway ACL rules with my ER605 connected to a Netgear GS724tpv2, and it seems to be impossible.  The devices on the separate networks still see eachother despite network to IP Group, IP Group to IP Group, etc. I ordered a TP-Link switch to connect to that then connects to the GS724tpv2, but I'm still scratching my head at why I'm having to do that.