Manually add VPN killswitch only for the guest SSID not effecting primary ssid

Routers VPN, DNS, Leaks
1

Hi.

I have a Marble now. My goal is, the router is in router mode, getting WAN internet from my home router's LAN port. I want to broadcast Guest SSID which is enforced VPN (easy to do) but the main SSID not (also easy to do) the problem is if I globally enable disable non-VPN, then the main SSID obviously loses internet because it's not connected to the VPN.

What I want to do is just implement a killswitch with a firewall rule or something so that the guest SSIDs won't work if the vpn gets disconnected. That way I can use the main SSID for max speed and no added protection or use the guest knowing that it will either be VPN protected or it won't work.

How can I achieve this?

Thanks

Edit, I am not 100% sure but I have unticked wan from the guest zone and it appears, as far as I can tell that all internet disappears once the vpn is disconnected. All sites stop and ping to 1.1.1.1 fail.Soon as I connect the vpn everything starts working on the guest ssid. Is this all that I need?

2

I would say that you don't need to do anything.

There is always a kill switch enabled if the VPN connection fails. If you disable VPN manually, however, it allows traffic. But if the VPN server fails or the connection itself fails, traffic will be blocked.