Hi @GRL,

tied, still not successful....

in the moment I activate last rule (deny all), nothing works. the allow rules are somehow overridden even if they're higher on the list of rules.

I have two rules for IoT <-> DNS and MQTT on Main (for each direction) and even those are overridden by deny rule on the bottom of the list.....

anyway, I could not find any deeper explanation of rule mechanism, especially for ACL Binding parameter....

additionally why the gateway ACL rules could deal only with whole networks?

I think, it is a common scenario on segmented networks to expose only some IP from one network to another.

my goal for configuring the rules for two networks (Main and IoT) is:

1. allow any client from Main to reach IoT devices
2. allow all IoT devices to reach only DNS and MQTT servers on Main LAN
3. allow all IoT devices access internet
4. deny all IoT devices to reach any IP on Main LAN except those in point 2

when this will be successful, I plan to move servers to new dedicated VLAN and expose only necessary ports to Main and IoT VLANs, but I'm not able to correctly isolate the IoT network.......

Hi @GRL,

yes, indeed, it seems so....

And gateway rules don't allow any other rules as for whole networks in LAN->LAN mode, IMHO really granular rules aren't possible.... 

This seems not what I was expecting from business class devices...

Even if in my scenario were only DNS and MQTT mentioned, to protect critical AD servers in the same manner (separate VLAN with access only to essential ports from outside) isn't possible.