@wuppi When the switches are managed by the controller I don't think they are doing layer 3 routing.

However, the Omada gateways allow traffic across LAN segments by default.  This can be restricted by applying ACLs to the switches.

So what you are seeing in the video is probably a result of the Omada gateway allowing LAN traffic by default and automatically applying NAT to all LAN subnets so no further configuration is needed.

In your case, you have a different firewall so that firewall is either blocking the inter-vlan traffic or not configured to have networks on that vlan.

  @wuppi Hi

You can still make 3 VLANs communicate with each other, however if you still want Internet access, your Router must support multi-nets NAT(can do NAT for different subnets).

I find an example for you, although it is using standalone mode but you may refer to:

How to build up a multi-nets network via Multi-Nets NAT feature on TP-Link router with L2+/L3 switches

  @Somnus thank you for the example. But maybe you picked the wrong one? Yours requires a router too ... 

  @wuppi Are you saying your firewall doesn't have the ability to inter-VLAN routing?

I am not sure what the capabilities of that particular switch are but to get the full layer 3 functionality of the Omada switches, you need to disconnect it from the controller.  The controller is very limiting as it relates to L3 switch functionality.

wuppi wrote

Is there a list / overview available, which L3 features are not available in controller mode?

  @wuppi 

That would be "Almost all of the L3 features"

There isn't much L3 switch functionality surfaced via the controller.

The only L3 switch functionality I have seen in the controllers is limited support for ACLs and the ability to add simple static routes.

  @Alex789 

Hi,
I finally found this https://www.tp-link.com/us/support/faq/2936/

This looks like a lot is possible. 

And also: I believe it got everything working!!

I need some more testing and playing with ACL - but it is promising. NO ROUTER used!

2 subnets:

Fritzbox: 192.168.0.1/24 (Internet) (VLAN 10)

.1 = Fritzbox (Internet Gateway, DHCP server for this net assinging gateway and dns to itself:192.168.0.1)

.2 = TL-SG2428P v4.0 (which is far too loud)

.x other clients

Guest: 10.10.12.1/24 (VLAN 20)

.1 = TL-SG2428P v4.0 (as DHCP server. Assigning Gateway = self 10.10.12.1 and DNS = 192.168.0.1)

.2 = client

Fritzbox static route:

IPv4-Netzwerk: 10.10.12.0

Subnetzmaske: 255.255.255.0

Gateway 192.168.0.2

That device is not VLAN aware, I believe it just forwards the packets. 

The ports on the switch have the correct vlan's assigned. 

Results: 
I can ping from Fritzbox clients to "Guest" members (switch 10.10.12.1 and 10.10.12.2 and others) 

Guests can ping the fritz box and other members in its network. They can also access internet. 

So do I understand it correctly:

With Gateways and static routes, everything is wired together. Afterwards it can be restricted with ACL?