@Dougie175 Check you have your other networks assigned to the uplink port on your router that connects to your first switch Using the ALL profile on all uplinks between switches and router

@Clive_A I just tested this Opened up NAT port forwarding TCP 80 + 443 to controller With a wan-in deny ip_any > ip_any rule, was still able to access controller from WAN. Looks like the port forward...

@Vincent-TP Will test once the hardware controller version is released.

@Colonic You can still achieve this with IP group ACLs rule 1: allow > wan in > ip_any > internal_ip_address rule 2 deny > wan in > ip_any > ip_any This will block everything getting to your lan...

@AIT90 Glad it helped you out You can achieve a LOT with switch ACLs if you are smart about how to group things togther and once you realise how the directions work, its pretty easy to build...

@KimcheeGUN actually, i just realised you can disable the WAN on that port as its a WAN / LAN - do that and it wont cause any problems.