As far as we know, the EX510 Pro doesn’t currently support VLAN tagging in AP Mode. VLAN functionality is only available on some router models (like the higher-end Archer BE/AX series) that have explicit VLAN options in their web interface. In Router Mode, the EX510 also doesn’t expose VLAN settings - so there’s no supported way to tag VLANs, even when using multiple SSIDs. Regarding guest isolation - disabling “Allow guests to see each other” only prevents communication between devices connected to the same guest SSID, but it doesn’t isolate them from the main SSID when the device is running in AP Mode. In AP Mode, traffic separation depends on your upstream router or firewall (in your case, pfSense/OPNSense). For proper guest isolation, VLANs or separate interfaces need to be configured on your firewall, not just on the EX510. You can try enabling “AP Isolation” to see if it fits your setup, but as you said, it will isolate all clients on that SSID, including your main ones, so it’s more of a workaround. Also worth noting - the EX510 Pro is an ISP-customized router, so some advanced options like VLAN tagging or full guest network isolation might be limited or disabled depending on your provider’s firmware

  @rg09214 

 

In general TP-Link home grade routers don't support VLANs.

For your setup is more suitable to have a dedicated home APs like these here or APs from Omada business series.

They support both Multi-SSIDs and VLANs.