@Bmark , Don't wait, because I would not be surprised if this future release does not handle your scenario. While many people will welcome more granular control on LAN->LAN, I suspect it will only...

Update: I'm experimenting with OPNsense in transparent filtering bridge mode inserted between the router and main switch. For this to be effective, the main switch has to be used for aggregation......

@Bmark , I sympathise with your pain. Wouldn't it be nice if the rules enforcement subsystem produced logs (like most firewalls do)? FWIW, in this thread: ER605 switching capabilities - Business...

@AngelaGarza , Using Omada, everything is allowed by default so it looks to me like rule 1, 3 and 4 are useless. The only thing that's blocked are packets flowing from IOT to 3 VLANs. You wouldn't...

@Bmark , It's been a while since I've been using an ER605 in standalone mode and I'm not going to drop it from my Omada setup to test but: It looks like all the IPs involved are in the same subnet....

@StephaneDupont , The gateway ACL would be DENY IOT -> DEFAULT. All communication initiated from IOT towards DEFAULT is dropped at the gateway (pure inter-VLAN control). All communication initiated...