@hidden0I very much appreciate you bringing that up in your design meeting. I feel that would be a very important feature to implement or else you would probably end up having to redo a lot of your rules if you implemented some down the road that should be at the top instead of at the bottom.   I thought that might be the case, but didn't try creating the rules and then restarting the GX. I just recreated my additional rules and restarted the GX and now everything seems to be working as it should.   I can ping 192.168.20.2 from both VLAN10 and VLAN30 I can ping 192.168.10.46 from both VLAN20 and VLAN30 I can ping 192.168.10.18 from VLAN30 I cannot ping any other devices on VLAN10 or VLAN20 from VLAN30 I cannot ping any other devices on VLAN10 or VLAN30 from VLAN20   Here are the additional rules I put in place before restarting the GX:   Deny Work to Main deny any From 192.168.30.0/24 to 192.168.10.0/24   Deny Work to IoT deny any From 192.168.30.0/24 to 192.168.20.0/24   Deny IoT to Main deny any From 192.168.20.0/24 to 192.168.10.0/24   Deny IoT to Work deny any From 192.168.20.0/24 to 192.168.30.0/24   So I think we are good to go for now and I appreciate the clarification. ... View more

@XydocqThank you for taking the time to do your own testing on this. I saw the same behavior so it is good to know it isn't just me. ... View more

Hi @Xydocq    Thank you for the reply.   I have been able to get a few things working but am still struggling a bit. Here is the full config of my setup and what I am trying to achieve:   VLAN10 - Main VLAN20 - IoT VLAN30 - Work 192.168.10.18 - desktop1 192.168.10.46 - desktop2 192.168.20.2 - printer   Would like VLAN 30 to be able to access the printer and the two desktops, but nothing else in those VLANs Would like VLAN 10 to be able to access the printer.   Here are the rules I have set up. Please correct me if any of these are wrong. I know a little about networking, but I have a lot to learn.   Allow Work to desktop1 allow any From 192.168.30.0/24 to 192.168.10.18/32   Allow Work to printer allow any From 192.168.30.0/24 to 192.168.20.2/32   Allow IoT to desktop2 allow any 192.168.20.0/24 to 192.168.10.46/32   Allow Work to desktop2 allow any 192.168.30.0/24 to 192.168.10.46/32   Allow Main to printer allow any 192.168.10.0/24 to 192.168.20.2/32   Now these seem to work fine, but where I am having the issue is if I make a Block Work to IoT/Main rule it doesn't work. deny any 192.168.30.0/24 to 192.168.0.0/16 I've also tried making separate rules and those don't seem to work either. (deny any 192.168.30.0/24 to 192.168.20.0/24 and 192.168.30.0/24 to 192.168.10.0/24). With either of these I can still ping other devices on VLAN10 from VLAN30.   Also, are these rules in top down format like other firewalls or does it matter with Meraki Go? If they are top down format, it would be nice to be able to move the rules where you wanted them as that functionality seems missing so far. I know this is a lot and I very much appreciate you taking a look! ... View more