Hello, 

TP-Link never replied on other requests and they are locked, so here we go again:

we need a dedicated setting "Client Isolation" or "SSID Isolation" for access-points to block all L2 traffic between the clients BUT allow for private network communication to other networks as some essential features for the guest might be located in another private network. 

Example:

- VLAN100 with a dedicated SSID is used for Guests

- Guest devices shall not see each other (works with current guest-setting)

- VLAN120 is a DMZ area with services that the guests shall be able to access, more specifically there is a web-interface that allows access to Smart-Home and IoT features that Guests need to access (like controlling media, TV, shutters, light) and there are also other services that are open for guests. This is currently impossible