How to stay invisible on Lan or be visible (VPN)


I have a GL.iNet router and I’m pretty happy with it. I no longer need a VPN on all of my devices. But there is one thing or better phrased feature I’m missing.

When I used my VPN (NordVPN) on Windows I had the setting available to stay invisible on LAN. In my limited understanding of networking that meant that my Windows PC was not able to connect and or see other local devices in the network for example a TV or in general any devices that was in the same network. I sometimes turned that off when I needed to access a specific device for example my printer. I would like to know how I can disable and enable this same setting in my GL.iNet router.

To be more specific. I want to turn it off when I don’t need it. All devices in the network should not be able to see or reach it other. But also enable it for the time I do need to access a device in my GL.iNet routers network. Very important to me is that in no circumstance the devices that are connected to the GL.iNet router can connect to my actual router. I want them to communicate with each other but in no possible way communicate to the devices that are connected to the actual router (FritzBox) (some still are). So in no way a printer that is connected to the FritzBox network can be accessed or seen by a device that is connected to the GL.iNet Router.

Right now my GL.iNet router is connect with an ethernet cabel to my Router (FritzBox). In the future I might want to move it and connect the GLInet router via Wifi to my actual router. Is there any difference I have to watch out for in the settings?

Is it even possible to achive this. Any help is appreciated.

This isn’t possible without significant changes in routing, firewall and system in general.
Not even sure if it’s doable with GL firmware, maybe you need to go plain OpenWrt.

Something like this could help: Effective client isolation with OpenWRT and multiple cable connected Access Points | Matthias Larisch
Client isolation - Network and Wireless Configuration - OpenWrt Forum

Well it would be fine if only the devices on the GL.iNet router could communicate and see each other. But I decently dont want that the devices on the GL.iNet router to communicate with the devices that are connected to my real (FritzBox) router. Can they do that right now, by default?

If you enable VPN this will happen by default until you enable Allow Access WAN

How can I check if this setting is disabled? And are you 100% sure that this setting alone is enough to make sure that no device that is connected to the Fritzbox can be seen by devices that are connected to the GLInet router?

As long as all is routed through VPN the Fritz!Box will not know about anything.

And the devices that are connected to the fritz box? And where can I find the setting with the wan?

The devices connected to the FritzBox will only discover the GL router - no device behind it.
Setting for WAN is located within the VPN settings in the GL GUI.

This option is exactly for this purpose.

So do I have to enable or disable it, if I DONT want the devices connected to the GLI router to be able to see or connect to the devices connected to the main router?

Enabled: Devices under GL.iNet will go to VPN and be able to access devices on the Main network.

Disable: Disvices under GL.iNet will go to VPN. Cannot access your main network.