So I am trying to setup a secure network for essentially all our smart devices here......

I want a normal network everyone users and then a devices network thats locked so that anything on it cannot access the network, preferably has it's own DHCP to set different DNS etc.

Now if I just click GUEST MODE on the network.....  It does seperate the devices out but eg.  We've tried setting up devices with our phones here and the devices can't communicate with the phone because anything on the guest network cannot communicate with anything else on that same network.  It's just like some dodgy thing TP Link have done?  Blocking out ALL local communication when it's in guest mode making it secure yes but useless for this.

So we move on, I can attach a VLAN ID number.......  but I don't have a phyiscal VLAN.......  I would like to be able to create a new LAN/DHCP for a particular VLAN number for things to attach to.

Am I missing something?  Can I not just have a seperated out WIFI Network thats seperate to everything else that works?.....