I have set up 3 VLANs each with a different subnet. I believe they are isolated from each other as I have not ticked the box joining each of these LANs in the Inter-LAN Routing table in LAN > General Setup (nmap confirms that it can't find the devices on the other subnets). However a guest device on LAN2 or LAN3 can access the login page for the router on 192.168.2.1 or 192.168.3.1. It's not a big deal because a guest won't know the password but I'd still prefer that they are prevented from even getting to this page. Is there a simple way to prevent this? I don't want individual client isolation on one of these subnets because it is for my two Tivo boxes which need to talk to each other.

Actually nmap does reveal that the router can be accessed from the other subnet. Using a laptop on wifi connected to a SSID on 192.168.2. nmap finds 192.168.1.1 and 192.168.1.255 so it appears that any of the login page addresses are available to the other VLANs. Maybe I'm going to have to accept that the password will have to suffice as a block to a guest user.

Under management you could set up permitted subnets and only include one subnet perhaps.