Our home network consists of a TP-Link Archer C7 ("router") and a recently added TL-WPA8630P powerline Wi-Fi extender ("extender").
On the router, we use the "Guest Wi-Fi" feature which works very well. Guest clients can access the internet, but cannot see the other devices connected to the router.
Yesterday I configured the extender via WPS ("Wi-Fi copy") and the main networks (2.4 GHz and 5 GHz) were correctly replicated to the extender, but not the guest Wi-Fi. So I switched on the guest network of the extender manually.
Everything works, but I noticed that clients connected to the extender's guest network can see and access the devices connected to the router's main network. For example, I can ssh into a Raspberry Pi connected to the router from an Android phone connected to the extender's guest network. This of course defeats the purpose of a guest network.
How can I configure router and extender properly so that the extender's guest Wi-Fi gets isolated properly from our main network?