@David11 I ended up with blocking LAN->LAN with source AP destination !AP type ANY, and LAN->LAN with source AP destination Me type HTTP.

@JamesLu This seems to be the solution except you can't block all access to the router (aka Me), so I just blocked HTTP. https://www.tp-link.com/ca/support/faq/4025/

@MR.S I created a second LAN and associated VLAN for the port connected to my guest network wifi AP, seems to work, but the new LAN still can access the original LAN. Any way to isolate the two?

thank you.

@MR.S Is there a good general reference on the VLAN behavior, tags, etc. other than the user guide?

I have an ER707-M2 for firewall/gateway with PORT1 (WAN) and PORT2(LAN), PORT3(AP). I am using PORT3 as guest wifi access point. I want to isolate PORT3 from the main LAN on PORT2 but retain internet...