Asus RT-AC87U - possible to disable access to intranet on wired users?

[superkake]

Hello, I have a Asus RT-AC87U which is currently running Asuswrt-Merlin. In my setup we have several users where it's very important to disable access to intranet on some of these users. I am using the guest network feature and I have created a seperate SSID where I am using the "disable access to intranet" setting which works perfectly for wireless clients, but I would like to have the same option for wired users, is this possible? I have tried searching around but I can't find any information on this. Is it possible to for example set LAN port 4 so it doesn't have access to the intranet? If that isn't possible, is it possible to do it individually with every device that shouldn't have access to the intranet?

 

[RMerlin]

Not easily possible, because the LAN traffic goes through the switch, therefore it never goes through the firmware's firewall rules.

 

[MTBer04]

Rather than get into scripting/robocfg commands to manipulate the firewall, it would probably be easier to buy a managed switch and do VLANing. TP-link has an inexpensive 8 port that should work, model TL-SG108E