My Guest VLAN Was Isolated From Everything Except the Router
With firewall rules finally on the box, I went back to the guest VLAN I’d set out to build. I isolated it cleanly from every other subnet, tested it, and shipped it. Then I realized guests could still walk right up to the router’s own admin page. The same blind spot from last time, pointed inward.