[pgte3]

What level of network isolation would I achieve with this configuration?

Router:
Router: ModelTP-Link TL-WR740N v4
Firmware Version: DD-WRT v3.0-r33772 std (11/16/17)

Current Bridging Table:
Bridge Name STP enabled Interface
br0 no eth1 ath0

Physical Interface ath0:
AP Isolation - Disable
IP Address: 192.168.1.1

Virtual Interfaces ath0.1:
Network Configuration: Unbridged
AP Isolation - Disable
Masquerade / NAT: Enabled
Net Isolation: Enabled
IP Address: 192.168.2.1

Note:
Each network uses its own DHCP server

Questions:
Can ath0.1 get to or "see anything" on eth1 or ath1? How does the answer related to the OSI model L2, L3 or L4?

[SurprisedItWorks]

Your VAP ath0.1 is effectively completely separate from ath0, except that they share radio parameters other than SSIDs. Things like isolation, inclusion in bridges, and presence in firewall commands are completely separate for the two. So we can speak of your br0 devices as those devices connected to either your ethernet lan interface eth1 or to the SSID associated with ath0.

So, your br0 devices can see and interact with each other. Your ath0.1 devices can see and interact with each other. But your ath0.1 devices and your br0 devices are isolated from each other in that no packet from either of br0 or ath0.1 will be passed to the other. So your ath0.1 devices and your br0 devices are isolated from each other.

Enabling net isolation on an interface isolates it from br0. However, if you have two interfaces that are not in br0 and enable net isolation on each of them, each will be isolated from br0 but they will not be isolated from each other. To isolate them from each other, you have to add explicit iptables commands to the firewall. This appears to be left over from early dd-wrt days when no one apparently considered that having more than a main network and a guest network would ever be of interest.

I believe AP isolation is implemented in the wifi interface itself, but I am not truly certain. Net isolation is implemented in the firewall, which I believe is one level up from the interfaces. Can't help you regarding how those are numbered Lthis or Lthat, etc. (My network education is minimal.)