AP Mode Guest Wifi - Intranet isolated by default ... Is there a fix?

[Livin]

I have 2 ASUS AC68R ... the second in AP Mode hardwired back to the first.

I have security cameras on Guest Wifi on both units... but only having connectivity issues on the second unit which is in AP Mode (app on other Wifi unit <-> cameras)
Looks like this is caused by the AP Mode unit not having a checkbox to allow Intranet access (ridiculous since the Router Mode unit has this checkbox).

So, some searching this forum a post from last year said...

guest access separation is handled by ebtables
you need to put the following ebtables config into your secondary AP...

ebtables -I FORWARD 1 -d Broadcast -j ACCEPT
ebtables -I FORWARD 1 -s xx:xx:xx:xx:xx:xx -j ACCEPT
ebtables -I FORWARD 1 -d xx:xx:xx:xx:xx:xx -j ACCEPT

Where xx:xx:xx:xx:xx:xx is the MAC address of the primary router's LAN interface (br0).

In short, this will allow the secondary AP guest networks to send broadcast traffic to your LAN for ARP and DHCP, and it will allow your router's LAN interface to communicate with guest users on your AP. By inserting the rules at the front of the FORWARD chain, the traffic will be allowed before it hits the DROP rules that does the guest separation -

-i wl0.1 -j DROP
-o wl0.1 -j DROP
-i wl1.1 -j DROP
-o wl1.1 -j DROP

... Has anyone done this and have experience with it?

Is there any other ways to accomplish getting the Guest Wifi networks to connect to Intranet?

thanks for the help!