@joelusi In this case, your client on guest WiFi will try to reach other subnets than its own via its default gateway, using the router’s MAC address. The guest filter on the APs is a layer-2 filter. You would need to disallow traffic explicitly on the router so that traffic between your guest VLAN and other VLANs is blocked. We’ll add an isolated VLAN feature in the near future to make this isolation easier.