@Clive_A I just tested this Opened up NAT port forwarding TCP 80 + 443 to controller With a wan-in deny ip_any > ip_any rule, was still able to access controller from WAN. Looks like the port forward...

@Vincent-TP Will test once the hardware controller version is released.

@Colonic You can still achieve this with IP group ACLs rule 1: allow > wan in > ip_any > internal_ip_address rule 2 deny > wan in > ip_any > ip_any This will block everything getting to your lan...

@AIT90 Glad it helped you out You can achieve a LOT with switch ACLs if you are smart about how to group things togther and once you realise how the directions work, its pretty easy to build...

@KimcheeGUN actually, i just realised you can disable the WAN on that port as its a WAN / LAN - do that and it wont cause any problems.

@Jason4 all vlans should be on tagged links between the switches, all the way up the chain. Only one vlan (it can be any but it needs to be consistent) should be untagged