@EricPerl wow great, thanks a lot for your efforts. This seems to do the trick for me. Let's see when the AP ACL limit will block me.

Hi @EricPerl, That was actually my first idea (to have a Guest-IOT-Wifi with gateway acl lan->lan blocking all egress from IOT). Although the Guest-Wifi also traffic coming Main vlan to the Guest-IOT...

@Death_Metal should this setup work for my use-case? I would like to set up an IoT VLAN that is - isolated (can't peer with others inside its vlan) - can't talk to any other VLAN - Home/Admin VLAN...