Access point behind nat Prohibition of access to the local network from wifi how?

Question

System administration

Good day
There is a local area network with stupid switches.
There is a task to set up wifi with Internet access but without access to the local network (to which the point is connected by a WAN port. There is a TPLink
WA701 available. because it is impossible to organize this using standard firmware;
does not work.via wifi from the access point you can get into the local
network.Settings:

[email protected]:~# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'



config interface 'WLAN'
         option ifname 'wlan0'
        option proto 'static'
        option ipaddr '192.168.88.1'
        option netmask '255.255.255.0'
        option dns '208.67.222.222'

config interface 'WAN'
         option ifname 'eth0'
        option proto 'dhcp'

[email protected]:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option network 'WLAN'
        option forward 'REJECT'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'WAN'
        option input 'ACCEPT'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config rule
        option src 'lan'
        option name 'BLOCK LAN'
        option dest_ip '10.38.14.0/24'
        option target 'DROP'
        option dest '*'

It seems that everything was done correctly and the addresses 10.38.14.0/24 from wifi are still available.
Can someone show me where my mistake is?

Answer 1

VLAN+Routes+Firewall

Answer 2

After reading about opernWRT, I learned that you can use iptables.
Removed all contents of /etc/config/firewall except for lines

config include
        option path '/etc/firewall.user'

in /etc/firewall.user wrote

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i wlan0 -d 10.38.14.0/24 -j DROP

And everything worked as it should, but why it didn’t work out with the firewal configuration with zones, the question remained open