I have a TP-Link EAP115 Access Point. I would like to setup a guest network, so that people who come to my house and use the WiFi cannot port scan the rest of my network. And I really only care about the wired devices: if several people are all on the guest Wi-Fi together, it is OK if they see each other's devices.
The TP-Link EAP115 has options for both a "Guest Network" and VLAN. At first, I was not sure which one to use, and a Q&A like the following leads me to believe just ticking the box for "Guest Network" is just as good -- or better! -- than a VLAN.
https://security.stackexchange.com/questions/246379/is-vlan-better-than-guest-wifi-feature
However, neither option seems to work with the AP that I have:
- even after checking the box for "guest network" on a wireless channel, wireless clients can continue connect to wired desktops, etc.
- when selecting a VLAN number (anything other than 0) on any wireless channel, all internet access drops for clients on that channel (other wireless channels are unaffected, of course)
Network topology is rather simple: EAP115 AP plugged into main router (ASUS RT-AX88U). AP has an option for Dynamic IP or Static IP (currently dynamic, using DHCP from the router) -- both AP and router, and all internal devices have internal IPs in the 192.168.50.* range.
This question seems to indicate that I need to setup access policies on the router for the VLAN to work:
How to setup a guest network?
There is no GUI on the ASUS RT-AX88U/Merlin for VLAN setup. Everything I have read about how to set this up on the command line is way over my head.
After discussing this with friends who do networking, they suggested the EAP115 is simply a cheap piece of hardware that is not working as advertised.
Is there anything obvious that I am doing wrong? I have not tinkered with any settings outside of the GUI on either AP or router, yet the "guest network" and VLAN settings in the AP do not seem to be working as advertised.
