resources: Buffalo router with DD-WRT, new Comcast Xfi Gateway
connections: Alexa devices, Chinese big screen TVs, android TV PCs, laptops, tablets, cell phones, PCs
objective: untrusted devices use WiFi on Buffalo for internet and isolated from LAN
My Buffalo router running DD-WRT was working well. For each of the two radios I had a VAP for guest use, isolated from the LAN. I decided to upgrade Comcast to the new Xfi Gateway for unlimited data and extra speed. The new modem/router combo works good, but of course is not as configurable. For instance I cannot create a VAP. The unit provides an isolated "Home Hotspot", but a Comcast login is needed and anyone on the street can connect. I could use the Home Hotspot for untrusted devices, but those won't show up on my list of connections and I can't follow use.
I decided to connect my Buffalo without DHCP and use for device isolation. Because I must connect the Buffalo with ethernet, if I isolate, I cannot get to the main router for DHCP, gateway, and internet.
It seems the best thing to do is use either port or IP filtering on the Buffalo. On the Access Restrictions tab the only section is WAN Access. Though there is a place to block services by port number, I don't think that will apply to LAN access because the settings are in the WAN Access section. I need advice how to do the port or IP filtering.