Hi @David-TP,

Many thanks for coming back.

I was actually typing a reply as your message came in - I'd been thinking this was a DNS-related problem from further reading on the community overnight (and some testing).

I've found that I can ping the internet fine, and if my device has cached a DNS response, it can also access that website. It can't resolve new domain names though, so DNS is almost certainly the culprit.

I don't have a separate DNS server on the LAN, but I do have a firewall that filters DNS traffic - this is likely causing the problem. The device I use is a Firewalla Purple in bridge mode between my main TP-Link switch (that the Decos are connected to) and my ISP router.

The Firewalla intercepts DNS requests, and has features to stop DNS traffic circumventing it, so is likely stopping the guest DNS reaching the DNS server on the router. The Firewalla also has it's own IP address, so I guess the Decos are assuming that it's a device on the host network and therefore (very cleverly, I must say) isolating it from the guest traffic.

Apologies for troubling you on this - I wasn't sure how the guest mode routed the traffic, but I understand much more about it now, thank you. I'll try adjusting settings on the firewall to either allow the guest DNS through - or somehow resolve it for the guest network. I'll report back when I've made some progress.

Thanks again for your help.

Best regards,

Dean

Hi @David-TP,

Just a follow-up: am I right in thinking that the X50 device isolation filters traffic at layer 2 (MAC address), rather than IP address?

I ask because I can see DNS responses (with wireshark) coming from my router/gateway IP address (192.168.0.1 in my case), but these don't reach the client with device isolation enabled. 

The reason, I believe, is that despite the DNS response having the gateway/router IP address, the packet has my firewall's MAC address.

My firewall (Firewalla Purple) sits inline between the ISP router and the Deco units. It intercepts DNS from the network to filter malicious/unwanted material, but the network 'sees' it as a DNS response from the ISP router.

Not a problem if that's how it works, but I wanted to make sure I understand why it isn't working - and to mention it in case anyone else has a similar setup.

Thanks again,

Dean