Guest Wireless allows access to other devices

[MTBer04]

Running Merlin's current firmware (380.65.4) for the RT-AC87. 'Access intranet' is disabled. Connecting to the guest wifi network, I can still access the router's sign-in screen and use RDP to remote into my desktop on the primary network.

Is this SUPPOSED to happen? Do I need to get a business class router that supports proper VLANing?

 

[RMerlin]

Is this SUPPOSED to happen?

It's a known bug with the RT-AC87U. Asus should already be aware of it, no word as to when it will get fixed (the RT-AC87U architecture is pretty unusual).

Other models with a more traditional architecture are working properly.

 

[sfx2000]

It's a known bug with the RT-AC87U. Asus should already be aware of it, no word as to when it will get fixed (the RT-AC87U architecture is pretty unusual)

Isn't that the QTN issue with 802.11 AP isolation?

Well, no, it's probably because to the Broadcom stuff - it's just another ethernet interface(s)...

Beware of LAN1 ports on the 87U, it's not just 5GHz... LAN1 hangs off the QTN chip... so if one is trying to do some policy stuff, 5GHz and LAN1 are tightly coupled there

 

[MTBer04]

Isn't that the QTN issue with 802.11 AP isolation?

Well, no, it's probably because to the Broadcom stuff - it's just another ethernet interface(s)...

Beware of LAN1 ports on the 87U, it's not just 5GHz... LAN1 hangs off the QTN chip... so if one is trying to do some policy stuff, 5GHz and LAN1 are tightly coupled there

The strange path that LAN1 takes through the circuitry is precisely why I have the uplink from my switch plugged into LAN4.

It's a known bug with the RT-AC87U. Asus should already be aware of it, no word as to when it will get fixed (the RT-AC87U architecture is pretty unusual).

Other models with a more traditional architecture are working properly.

Thanks for confirming it's a bug rather than by ASUS' design. When I bought this thing a couple years ago, I thought I was investing in some minor degree of future-proofing (as much as one realistically can expect with routers/tech). But this bug, the odd behavior of the LAN1 port, and the incompatibility of the 5GHz radio with RADIUS authentication make it seem half-baked and cobbled together.

That said, thankyou for even bothering to support it with your firmware