I've had a 2860 since they were launched, am just setting up a second SSID onto another VLAN, VLANs are enabled etc, DHCP setup for a second scope, its tagged to SSID 2 so all setup as per the guides like this one https://www.draytek.co.uk/support/guides/kb-wireless-guestnetwork?return=8797464

However, when a client connects to SSID2 they get an IP address but all I can do is ping the gateway, have no internet access or able to ping past the gateway, have checked firewall settings and all sorts but it will not let SSID2/VLAN2 out.

Routing table shows the VLAN2 following the same default out as the untagged working network.

Any ideas?

What DNS do you have set up for LAN2?

Just Google primary and secondary, any client on LAN2 does get given them. Cannot ping anything past the dryatek though.

Looks like a firewall issue perhaps but have checked the settings and the syslog can not see it blocking the LAN2 traffic.

Maybe you need to set the primary DNS for LAN2 as in the Draytek example?

No difference, and it wouldn't explain a traceroute to public IPs not getting past the gateway.

Make sure WAN's and LAN's all point to the 8.8's DNS's.

Try routing policies, the two subnet pointing to the WAN also.

In LAN >> General setup, make sure you have forced the router to use the DNS server in LAN 1 also.

Regards