@Riley_S 

Thanks for the quick response! Here are my answers:

• to check connectivity from the IoT network, I connect to that Wifi on a laptop and ping several devices on the main network. The pings succeed. I can also view the web pages for my printers and I can access my NAS, all on the main network, which should no happen if yourIoT network is isolated.
• I currently have a "3 router" solution. First, I have a TP-Link AX55 which connects to the cable modem on its WAN port. Then I have both a Deco M5 mesh network (for my current IoT devices) and this new Deco X55 "main" mesh network (for my computers, printers, NAS, etc), each of which has their WAN ethernet port plugged into a LAN port on the AX55. This way, my main and my IoT networks are physically isolated. Each of the three routers has its own DHCP server, with non-overlapping IP address ranges (in particular, 192.168.205.xxx, 192.168.206.xxx, and 192.168.207.xxx). That is, each is acting as a separate router, not as an AP (although the mesh nodes for the two mesh networks -- Deco M5 and Deco X55 are effectively acting as mesh APs on their respective networks).
• For my test, I enabled the IoT network on the new Deco X55 system, connected to it from a laptop, and started pinging and accessing devices on the main network. As far as I could tell, everything was fully accessible.

Yes, please forward the suggestion for "Allow Local Access" to your team. Some IoT devices require that the configuring computer (typically a smartphone) be able to access the device directly. Also, for example, I have Google Home devices on my current IoT network to which I cast audio from my phone, but only if my phone can see the Google Home device on its WiFi connection, so in this case the feature is required, but sometimes it might be nice to turn it on or off. If you have to pick a default, then "Allow Local Access" would be my recommendation.

I hope this helps. I am very happy to discuss or explain as much as necessary to clarify. I am a software engineer, so I know that at times direct customer feedback can be really helpful.

Doug

  @dwhiting56 

I have attached an image with a network map for our house. You can see that the main network (Twofish, Deco X55) and the IoT network (iotaMesh, Deco M5) cannot talk to each other, but the devices on iotaMesh network (Deco M5) can all see each other.

This is what I would like, as well as that "Allow Local Access" option switch for the Deco X55 IoT network (and, imo, for the Deco X55 guest network too)

  @Riley_S 

Any update on this? I have the same exact problem and have done the same troubleshooting.  It serves no purpose to have an IoT network that can still reach everything on the main network. They should be in a different subnet and have access policies that block that traffic.  Like you said, like the guest network.

  @Riley_S 

Thanks for letting the R&D folks know about this. It would be wonderful to have that feature, especially with the two configuration options I mentioned in an earlier message, which were available on the guest networks of some older TP-Link routers (e.g., Archer C9): namely, (a) allow IoT devices to see and be seen by devices on the main network, and (b) allow IoT network devices to see each other.

However, your reasoning for the current Deco X55 IoT network configuration isn't very convincing (or is just wrong). For example:

1. yes, IoT devices often want to communicate among themselves, but your list (smart hubs, TVs, fridges, etc) should all be on the IoT network, and they would need (at least) the option to communicate among IoT devices on your IoT network. Isolating those devices from my main network (computers, NAS,etc) is critical for security purposes, since IoT devices are well known to be hacked, often without firmware updates. This isolation is what I do, using 3 routers, and it isn't hard to control/manage those IoT devices when needed, whether through the vendor app/server or by connecting temporarily to the IoT network. I hoped that Deco X55 would do this for me in one mesh system , so hopefully that can still happen with a future update.
2. your assertion that having an IoT network helps with bandwidth is just silly and wrong. All devices on the Deco router are using the same WiFi, so there is no extra bandwidth. Yes, I guess you could configure it so that, for example, the main WiFi used only 5GHz and the IoT WiFi used 2.4GHz, but that's true whether or not the IoT devices can see nodes on the main network, and in any case that is just dividing the bandwidth, not adding anything.

Thanks!

  @dwhiting56 I'm having the exact same problem on my Archer AX53 here in Brazil, HW version 1.0, FW version 1.1.5 Build 20230516 rel. 41162.

With my smartphone connected to the IoT wireless network, I can see and ping to all devices that are clients of the router, including the ones that are connected on the main wireless network, which should not bê possible.

Addtionally, when I'm connected to the main wireless network, I can't see or ping any IoT device connected to the IoT wireless network, only can see and ping devices of the main wireless network.

As it is, the clients that are connected to the main wireless network have "limited power" and the clients that are connected to the IoT wireless network have "unlimited power", seeing and communicating with all devices with no restriction, voiding the most important and declared feature of this IoT network, whick should be the complete isolation of IoT devices from the rest of the network.

I've already sent a message to TP Link's support in Brazil, waiting for a fix for this problem.

  @Riley_S  To pile on here, the default really does need to be that any device added to the IoT network cannot talk to the main network nor talk to other devices on the IoT network. That's the secure by default design. Then features should be added as needed to temporarily allow more lax network connectivity for the whole IoT network (eg when required for some device setup), or to configure the more lax settings permanently per IoT device based on MAC address.

I just ran an nmap scan from my IoT network and I'm pretty flabbergasted.  I thought all of my $10 totally-insecure IoT sensors from totally-not-trustworthy-country-X  were fully isolated because they were on the IoT network ... and they are not by a long shot.