Have used DDWRT on Dlink 315 and now ASUS Merlin on RT-AC66 and on. Currently installed on AC1900P and AX88U. Prevous experience shows VAPs on separate subnets and firewall rules that controlled access to lan and wlan. AX88U creates BR1 for wl0.1 and wl1.1, but doesn't assign these interfaces to new bridge br1. Devices connected to guest-1 network (wl0.1, wl1.1) are assigned IPs from primary DHCP pool on BR0 and there is no isolation since they are all on same subnet. Enabling guest-2 creates a br2 but again interfaces are assigned to br0. Enabling guest-3 doesn't create a br3 as expected. NOTE: I use IPv4 for personal lan.