7800N firewall filtering LAN to LAN

[slimgym]

In my quest to stop visitors accessing LAN resources (in the absence of multiple SSID's and guest network access), I wanted to use the IP filtering to block access to LAN resources from their IP range. I have already set up DHCP address reservation for my own devices, the visitors have dynamic DHCP allocations < 192.168.1.50.

The dialogue boxes say "internal" and "external" but I hoped this actually meant "source" and "destination".

I setup a rule with "internal" 192.168.1.1~192.168.1.49 and "external" 192.168.1.100~192.168.1.249.

Unfortunately testing showed these rules only act across the routed interfaces and not across the LAN.

I guess this would suggest the LAN is just a switch and is not routed, in which case what I request may not be possible, but if it is, please consider it for inclusion.