I'm attempting to set up two VLANs - one which uses all physical ports plus SSID1, and another which only uses SSID2.

I've set up VLAN0 to use LAN 1 and VLAN1 to use LAN2.

LAN1 is configured to use IP address 192.168.1.1 and DHCP server is enabled starting at address 192.168.1.10. Gateway IP address is 192.168.1.1. This is working fine, all devices have internet access whether using LAN or WLAN connections.

LAN2 is configured ro use IP address 192.168.2.1 and DHCP server is enabled starting at address 192.168.2.10. Gateway IP address is 192.168.2.1. None of the clients on this LAN can access the internet. The can ping 192.168.2.1, but nothing else, including private or public address and websites, and can access nothing in browsers.

Is there a step I have missed out on? I've followed Draytek instructions to the letter as far as I can tell.

Enable a route policy so that any source IP can access any destination IP via the WAN you are using? Test it via the Diagnose facility.

Thank you so much, that was it - enabled this using the appropriate WAN, and now clients can connect. Odd that's not mentioned in the Draytek docs.

It's not typically necessary to add that, though it does work around what I think could also cause it. The LAN1 subnet has no option for NAT / Routing mode, it's a NAT subnet. The LAN2 and other VLANs have an option for NAT or Routing mode - with routing mode passing the traffic direct to the WAN without performing network address translation.

If the LAN2 subnet is set to Routing mode and the Internet connection doesn't understand what to do with those IPs, that will cause the behaviour that you're seeing. The Route Policy rule goes around this by sending that traffic to the Internet using NAT instead of routing.