Just got through the other replies after responding to the earlier ones, sorry - my other issue is not having the time I need for this right now.

Config clash between the two LANS seems the most likely explanation.

Answers:
- a VLAN using subnet LAN2. The VLAN includes only SSID2. It's possible I configured this incorrectly and this is causing the issue. I've configured it with:

For NAT Usage
IP Address: 192.168.2.1
Subnet Mask: 255.255.255.0
DHCP Server Configuration enabled
Start IP Address: 192.168.2.10
Gateway IP Addres: 192.168.2.1

- So yes, the Draytek is (was) serving IPs for LAN2
- The Draytek serves the WiFi
- No VLAN routing
- No IPv6 addresses for the client, and IPv6 is disabled across the Draytek.

Sorry for the delay and I appreciate all the help.

shaneoh1980 wrote:

footsore wrote:
With two 2860s that is easily overcome. First (connected to modem) 2860 is open network with Wifi for guests. Second is plugged into first and operates the secure network. Separate subnets, You can see out but guests can't see in.

No, Yes, or the other way round.

Router A has Broadband and Fibre connected to it and serves guest wi-fi
Router B WAN port is connected to any network port on Router A
Router B provides all internal services (except guest wifi)

You are protected from guests by Router B firewall, and from internet by two firewalls. Overkill in terms of hardware but would get you where you wanted fast.

No good if you need incoming ports for SIP/VPN etc.