Assuming you have also ebtables (or ebtables-nft) in addition to iptables on the router, and that all the (W)LAN interfaces are bridge slaves to the same master (say named bridge0):
ebtables -I INPUT -i ath0 -j mark --set-mark 0xabcd
iptables -I FORWARD -i bridge0 -m mark --mark 0xabcd -j DROP
(Note that the mark value 0xabcd is arbitrary.)
This causes all ...