WiFi client isolation with VLANs and remote gateway

[mkx]

My question: is it possible to enforce client isolation across a wider network, i.e. so that each member of the IoT VLAN can only communicate with the gateway?

Sure thing. VLANs are actually something running on top of ethernet. It’s industry standard, so your pfSense supports it as well. The only thing for you to do is to tie different virtual APs on your hAP ax2 to appropriate VLANs and configure connection between hAP ax2 and pfSense as trunk (carrying multiple VLANs).

Here’s tutorial on how to do VLANs with examples. You want to follow the “Access point” example, but you can make a hybrid with “Switch with a separate router (RoaS)” if you want to use also ether ports on hAP ax2 as well.