for any readers of this undocumented buggy features.

if you use ip address reservation. any devices in the "main network" either with static or reserved ips are always shared to the guest network.
I assume the address separation is gone all at the dhcp level and is buggy as hell.

if you have any servers or nas etc with static ips or iot devices u want to reserve.

1- DO NOT enable guest allow network as these are shared by default.

2- AP isolation on the main network is wonky it only prevents the wireless devices provisioned with dhcp to not see other devices provisioned with dhcp. it will always show the static and reserved ip sets regardless. For my use case I left it enabled and it just prevented access within the only 2 devices in the main network with dynamic dhcp allocation.

IMO this is a lame way to implement network isolation and firewall ruling.
At least it could be better documented in more complex scenarios and not let users to discover and think its a bug.

Although it looks and feels like a buggy implementation while is not.
 

what a secure network looks like is

1: devices in LAN ports

2: devices in main-wifi

3: devices in guest-wifi

devices in lan can access internet and can see main and guest wifi devices.

devices in main-wifi cannot see devices in guest-wifi but can access lan devices such as nas or dns server.

devices in guest-wifi can access lan devices such as a nas or dns server and internet but cannot see main-wifi devices.

this has eternally been impossible in tplink routers. always one side does not work and leads to compromise. if you enable in guest that devices have access to local they can see the wifi devices in the main wifi network. allowing my guest for example to scan my network and discover my phone when they should only discover my nas.

  @sbearg  the same on ax23

Archer ax 23 device isolation - Home Network Community (tp-link.com)

after more mingling around ended up with this setup

network > dhcp server > reserving X number of IPs

wireless > aditional settings > enable ap isolation on main network

wireless > guest network > disable allow guest to see eachother, enable allow guests access local network

I make sure all devices that need to be accessed by everyone such as DNS, NAS are either STATIC IPS over ethernet or are DHCP wireless reserved ips (a wireless printer or chromecast guest room for example).

This allows

my lan devices to see all devices across, lan, wireless main, wireless guest (i have nmap network scanners running)

my guest wireless devices can access pihole, and chromecast devices but cannot see any other non ip reserved main wireless devices

my main wireless devices can see guest and lan devices (while is not ideal that they can see guest devices at least guest devices can't see the main wireless that are non dhcp reserved devices)

the main flaw IMO is the combination of dhcp reservation to allow sharing cross networks.

but i assume someone might call this an undocumented feature