@barnyb, if you can ping the gateway router and its DNS server but not any site on the Internet, the router almost certainly blocks traffic to the WAN zone (Internet). For the firewall of a router incoming and outgoing traffic (to/from the router itself) is different from forwarding traffic (from LAN through the router to the WAN zone and vice versa). This are usually three separate firewall chains.

Next are ACLs in Omada Controller. If you did create an Allow ACL for some local IPs or subnets, all other IPs not explicitly allowed are blocked by default. In this case, reverse the logic and use a Block ACL to block the IPs or subnets you want to deny access to and exclude the local IPs or subnets inside the blocked subnets to which access should be granted. In the latter case, the default action is to allow all other IPs.