DDWRT - Virtual Interface - firewall command - RDP

Question

I have DD-WWRT flashed on my Linksys e2500v3 router.

I added virtual interface to create a guest wifi network that would have access to the internet, but not to the private network or router.

At this point, guest network can access internet but when I try to RDP from a PC on my private network (outside of the ddwrt router) to another PC on the private network (that gets its IP from the ddwrt router), it doesn't work.

I've narrowed it down to this command:

    iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`

When this command is commented out or deleted, guess network no longer has internet access but I can RDP into a PC connected to the private network of the ddwrt router from another PC on my private network (regardless of the subnet).

When the command is active, guest network has internet but can not RDP.

Setup on DDWRT router:

WAN: disabled
LAN IP: 192.9.202.250 (was an available IP on my network)
DHCP range:  192.9.202.160-192.9.202.165
Private WIFI: wl0
Guest WIFI: wl0.1
Created bridge: br1 (IP 192.168.5.100)
Assigned bridge: br1 assigned to wl0.1
DNSMasq:

    #Enables DHCP on br1
     interface=br1
    #Set the default gateway for br1 clients
     dhcp-option=br1,3,192.168.10.100
    #Set the DHCP range and default lease time of 24 hours for br1 clients
     dhcp-range=br1,192.168.10.101,192.168.10.105,255.255.255.0,24h

Firewall commands:

    #Allow guest bridge access to Internet
    iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
    iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

    #Block access between private and guest
    iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
    iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP

    #NAT to make Internet work
    iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`

    #Block guest access to router services
    iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
    iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
    iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
    iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset

The target PC is 192.9.202.165

The source PC is 192.9.202.140 (this IP is provided by the main router, not ddwrt router)