@jra11500 - there are none - there is only a vlan config - sorry for the confusion. Subnet 192.168.190.0/24 (vlan-id 390) is hosted bij the OpnSense router (i.e. a vm on a proxmox server). Which...

@jra11500 - thank you for the quick follow-up. The bigger image at the end of this post shows the topology. Here you see dozer on the left; i.e. the Omada ER707-M2 router (with ip-adress...

@jra11500 - thank you for the detailed explanation. Unfortunately that feature only works if the router is doing the vlan routing. Which is not the case for me - for performance reasons I'm doing...

I'm struggling with gateway, switch and eap type of acl rules. I'm trying to find a way of isolating 2 vlans from the rest. Meaning only internet traffic is allowed for these 2 vlans. For that I have...

@GRL - which probably means that the isolation only works for packets passing the Omada gateway? Meaning that if a L3 switch is involved with IP-interfaces in all vlans this feature has no effect?...

@GRL - ok - great. But it seems only available when an Omada router is "hosting" a given vlan/subnet? Meaning if it is "hosted" by an external device - for example pihole - it doesn't show?