Guest AP VLAN Setup

Question

I have a wireless access point that supports multiple SSID's. I have SSID "Private" with no VLAN and SSID "Guests" on VLAN 30. 
 I have created an Ethernet VLAN interface for VLAN 30 and a DHCP server to go with it. (Private network is on 192.168.1.0/24 and Guests is 10.10.10.0/24.) 
 The Private network functions fine but the Guests network cannot access the internet (though the DHCP server is working). I assume something needs to be done about masquerading but I'm not sure how to proceed when dealing with VLANS.

Jas Man · Accepted Answer

You are on the right way. 
You must create a NAT rule for the IP range of your new guest VLAN. 
Go to "Network Protection" -> "NAT" -> "Masquerading" 
Create a new Masquerading rule. Choose the guest network as "Network", and the WAN interface as "Interface". If you have different addresses on the WAN interface you can also choose the IP address for NATing (means "Dear UTM, please translate incoming packets from [this] IP range to [this] external address"). 
 
After that, create a firewall rule to allow the clients of your guest network the access to the internet.