Replying to myself.
I got the switch and finished setting up. It does not appear to support mac wildcards for mac based vlan. I tried 00, and FF as the wild card characters. Rejects * as well. So each unique mac must be manually entered.
I suppose if there's a long list, one could make a backup which is text based, then following the existing format, paste additional macs in there, restore.
Functionality; My set up at this time is using sophos utm. Each vlan has its own dhcp server assigned along with various firewall and masq rules. The setup does appear to work.
I'll need to use a linux client to do some probing to see if I can see what leaks over on the wifi side from clients on different vlans.
What is missing from the initial steps is the pvid screen, which proved quite important. It is important to assign all pertinent vlans as UNTAGGED in the configuration. In the example below, physical port 8 is the one feeding the orbi device.
For now it's configured with 2 vlans, 4 and 5. Proper connectivity would not happen until vlan 4 and 5 were configured as untagged. PVID of 4 means any undefined (no mac vbased vlan entry exists) mac will be defaulted to vlan4.
0187b852-a37d-4e88-b966-140ef2128862-image.png
The rest of the lan operates on vlan1, which is not assigned to that port at all. I may make special routing rules later for a few things (like WOL using app on phone). For the most part, I don't want anything wifi having access to the main network.
The switch cost me about $50, the orbi's cost nothing. I am hopeful sometime in the near future someone figures out how to gain console access so the whole vlan mess can be untangled and defined properly. It's a bit odd having the same ssid/wifi password for the guest network as other networks.