Wire interface isolation + DHCP

[acedev]

Hi everybody

I've been trying to archive the following setup with Asus AC86U + latest Merlin FW RT-AC86U_384.7_2:

1. 2 wan interfaces in h9standy mode. Got this with

nvram set wans_standby=1

setting

2. Isolated subnet with externa DHCP server. Just disabled DHCP on br0 using web interface. External DHCP works with 192.168.0.0/24 subnet.

3. Isolated eth1 interface with separate internal DHCP server range
Got this with

    ip link add br2 type bridge
    ip link set eth1 master br2
    ip addr add 192.168.1.1/24 broadcast 192.168.1.255 dev br2
    ip link set up dev br2

+

    interface=br2
    dhcp-range=br2,192.168.1.100,192.168.1.254,255.255.255.0,86400s
    dhcp-option=br2,3,192.168.1.1
    dhcp-option=br2,6,8.8.8.8,8.8.4.4
    dhcp-option=br2,252,"\n"

4. Isolated wl0.1 interface with separate internal DHCP server range
Got this with similar to above solution with eapd custom settings found here in forum.

5. Custom routing solution with ipset, ip route and iptables. Important note: there is no routing between bridges, they are isolated.

Problem is looks like router works like a regular switch during the boot and eth1 interface is connected to br0.
In that time client station gets lease from external DHCP server, lets say 192.168.0.10. After all bridges have been configured it tries to update lease and in some way gets through all iptables rules to external DHCP again.

I closed all br0 <-> br2 communtication through iptables in FILTER table and thought it may be related to dnsmasq, which listens on all interfaces in bind-dynamic mode and may just proxy request. I tried to kill dnsmasq from console during DHCP request, again, no luck.

When client tries to get new lease it suggest old IP address 192.168.0.10, I see this request in br2 with tcpdump.
Then I see DHCP answer from external DHCP on br0. What really bothers me I don't see DHCP request on br0 and DHCP response on br2.

Then I though it may be related to HW acceleration on the router. I tried to use

nvram set fb_disable=1
nvram set runner_disable=1

commands, but I'm not sure they really disable acceleration or that's just some kind of flags.
At lease web interface showed both of them are disabled. This didn't help neither.

Finally I got the idea I just can't take out eth1 from br0 because it is set up already somewhere inside FW as a bridge and what I do with brctl command makes no sense. I've found mention of robocfg command, which is unavailable and replaced with with ethctl, however there is no information on this command yet.

Could somebody clarify this situation?
Is it possible to setup such configuration?

Thank you in advance.