@Jay86, firmware version 1.6 for EAP225-Outdoor did fix a bug with VLAN leaks.

The correct way to use VLAN-mapped SSIDs is to terminate the VLAN in the router, not in the switch (except on L3-capable switches).

This means you have to create three subnets in your router, one for each SSID. Port 1 (the one the EAP is connected to) of your switch must be a tagged member in all three VLANs (1, 10, 20). If you don't use a Management VLAN for the EAP itself, it needs to be tagged, too.

From your description we can see that you use an asymmetric VLAN setup to share the same subnet among the three VLANs (e.g. traffic from clients in SSID C to the router uses tagged frames in VLAN 20, but traffic from the router to clients in SSID C uses untagged frames in VLAN 1). Asymmetric VLANs can't work with VLAN-mapped SSIDs. The router (or the L3 switch) must send traffic tagged with VLAN 20 in order to reach SSID C.

This is a correct setup for a VLAN-mapped Multi-SSID network (P3 is tagged member of all VLANs, P4 is untagged member of VLAN 200 only):

@Jay86, MAC filtering is unrelated to VLANs:

@Jay86, good if it works for you.

Indeed, Fritzbox knows subnetting internally, but they hide it under »Guest Network« and »Network Settings« in the web UI. It allows for two subnets which have subnet IP 192.168.178.0 and subnet IP 192.168.179.0 by default (or a user defined network IP X.X.Y.0 and X.X.Z.0, where Z = Y+1). Thus, you can create two subnets at least. With a business-class switch you can assign them two different VLANs.

It's a pitty that FB can't do VLANs itself (AVM told me two years ago in a letter that VLANs are a »too sophisticated technique«). So I decided to use an UBNT EdgeRouter which runs an open (accessible) Linux system and to use the Fritzbox only as a cable modem, as a phone router and to heat my machine room in winter.

Guest network can be mapped to port 4, WLAN can be disabled:

Two subnet IPs can be chosen, where second subnet IP is always the value of first subnet's last network octet +1:

@Jay86, yes, the EAP110-Outdoor still has this VLAN bug. But that means you don't have privacy (no true VLAN isolation, package leaks). Just do a network scan to see what I mean. What's more, TP-Link might probably fix this bug in a future EAP110-Outdoor firmware, too.

It's not possible to use asymmetric VLANs unless you rely on a bug like this or unless you can assign a single SSID to more than one VLAN (and I know of no AP which lets you do that).