Hornbyp, thanks very much for your assistance.

I connected my laptop to the trusted network via ethernet cable, and then used the DGND4000 router AP admin page, which I am using as the wireless AP for the IOT network on 192.168.2.0 subnet, as the ping and trace route target to assess firewall performance. Straight away it worked, either passing or blocking packets as per the firewall rule. So you were absolutely correct, the Draytek IP address on each subnet is treated differently and not subject to firewall rules. I guess, in theory, the packet is not leaving the router and so therefore is not tested by the firewall, even though it is on a different subnet.

So I should be able to setup the firewall rules as we suggested, using IP objects and groups to specify specific rules for IOT devices requiring internet and internet and LAN connectivity.
I suppose to be completely secure, I should work out what ports each IOT device needs on the local network and only open these, rather than a carte blanche pass on any port for a subset of IPs.

Thanks again, I am glad it was my testing target rather than my understanding of how firewall rules work. I was beginning to worry ....

To continue this rather than start a new thread, I'm about to setup exactly the same thing as described here.

The only hurdle I don't know how to overcome yet is those services than use broadcasting features to discover devices. I'm thinking Apple's Bonjour (mDNS?) technology and similar to discover AirPlay targets, AirPrint, SMB servers, Homekit etc and some App based IoT devices like Honeywell Thermostats and Philips Hue which all use broadcast based discovery methods to connect their Apps to the device in question.

Does anyone have any good solutions here?

pharcyder wrote:
The only hurdle I don't know how to overcome yet is those services than use broadcasting features to discover devices.
Does anyone have any good solutions here?

No, just the clunky method of manually swapping SSID on my phone, whenever I want to access something on the "I.O.T." LAN.
(Or relying on the device's 'cloud interface' and accessing it as though I'm off-site).

Otherwise, some sort of 'proxy' is presumably required on each network segment? Perhaps that already exists for mDNS? ...

Multicast routing is what we need - not sure if DrayOS supports it but I'd hazard a guess and say no. I shall investigate other solutions and report back if I find anything.

mDNS repeaters is the solution