@Hank21 thank you for your answer, unfortunately it does not helps me with my issue. As you can see on the sequence diagram located on the page you've linked, on step 2 the EAP redirects to the controller and on step 3 the client contacts the omada controller. However the client has no access to the IP of the controller and should not have knowledge about it (why would anyone share with unauthorized clients the IP address of infrastructure related devices ?)

The client can have access to the controller through another IP which is behind a firewall, and I'm looking for a way to configure it. Hence my question: "Is it possible ?" or "will it be possible in a future version" ?

Or am I simply missing something ?

Hi  @kraal ,

since portal uses port 8088 and 8843 you could try if it is sufficient for you, if you block  management port 443 and 80 in firewall for guest vlans via ACLs with use of port-groups.

And a rule to denie whole rest of 10.10.10.0/24 except gateway, dhcp-server...

If you use both - wlan and lan - the ACLs have to be set up in EAP-ACL and Switch-ACL.

Greetings