"Internet only" mode doesn't seem to work

[ebuckland81]

You could, or probably should, accompany Internet only with Isolation on the same VLAN, and/or explicit firewall drop rules, given that all those internet only clients are placed in the same VLAN and no non-internet only resides in the same VLAN. As understand it, Isolation implicitly impose firewall rules to block inter-vlan traffic to and from that VLAN.

Here is an earlier comment on this:

VLAN's with the Route 10

@joelusi In this case, your client on guest WiFi will try to reach other subnets than its own via its default gateway, using the router’s MAC address. The guest filter on the APs is a layer-2 filter. You would need to disallow traffic explicitly on the router so that traffic between your guest VLAN and other VLANs is blocked. We’ll add an isolated VLAN feature in the near future to make this isolation easier.