Intervlan routing is allowed by default at switch side? Also at gateway side? 

If i need stateful acl, i need to use acl gateway? And if i use acl gateway i need to also block intervlan at also switch side?

Sorry but i'm confused and didn't found clear documentation about ACLs i omada controller.

  @Tedd404 

Thanks for answer.

But what i woud like to know is if using gw acl the traffic is routing at gateway phisical port or at switch ports. 

That's because in router on a stick setup (switch woth vlans -> gateway) if it happens at gw port, the data link between switch and gateway will be shared amoung wan and intervlan traffic. So, if i should have huge data traffic beetwen vlans this will decrease wan bandwidth.

Please, can someone explain me? 

If, as it seems, switch allow ip traffic to route between vlans by default, if i block intervlan routing at gateway side with gateway ACL (LAN-LAN direction), routing between vlans will continue to work at switch side? If not, why?

  @Tedd404 

Hi, 

maybe my bad english was not suffcient to explain me good. Stay quite, i know OSI and base of networking, i'm sw developer but not completely networking savvy.

I cannot test by myself, i'm new in omada, and before i going to buy equipments i would know if them can suite my needs.

What i wrongly understood, is that layer 2 switches in omada was able to do inter-vlan routing without the need of a layer 3 device, such as gateway. That's because of faq 3091 that use switch ACL instead of router/gw ACL firewall, and above all reading old reddit threads that let me misanderstanding the things.

Now i understand that LAN-LAN ACL on omada was introduced one year ago. And after let testing a friend omada equipments, i understood that L2 switch can't do inter-vlan routing without an L3 device, as it right to be.

Now that i understood how things are, i anyway would ask you:

1. Why, in the gw, we cannot specify ACL for different LAN gw ports? As i see in emulator, we can just apply ACLs to LAN-LAN or LAN-WAN, but them are apllied to all LAN ports of the gateway, i suppose.

2. Why, with LAN-LAN ACL on gw side, we cannot use ip groups? I cannot understand, anyway, if this is a limitation on controller mode or if it also works this way in standalone mode.

Thanks a lot.