Please note that my policy is consistent with your scenario, guest SSID uses VPN, master SSID does not use VPN.