Hello. I need to configure firewall so user with certain IP range (for example 172.16.10.X) will be completely unable to interact with LAN devices, but able to connect to the internet
I need it to work without vlan, because there are some switches in the network which are not supporting 802.1q.
Thanks

Those of your switches, that "doesn't support 802.1q", won't know anything about your router's firewall rules, and they will gladly pass traffic between different LAN clients.

As for the clients that need access to outside blocked, the solution is pretty straightforward: you need to create a rule in your firewall forward chain that will drop everything with src-address from desired address range and out-interface - your WAN interface, and place this rule higher than the default rule that allow access from lan to the outside.

If the devices you want to isolate are part of same IP subnet and dispersed around different switches, then it is not possible to do what you're trying to do.
Connectivity between devices within same IP subnet is generally direct ... without using some router. If you can move all "isolated-to-be" devices into one physical branch of network and none of other devices are in same physical branch of network (I'm talking about ethernet layout here), then all communication between these two parts of same subnet will pass common point and if this point is a routerboard, then you can configure bridge filters to disable the connectivity.

However, if you were able to do that, then it would make more sense to have two IP subnets in the first place.

To ammend what @xvo writes: non-VLAN-aware switches are not problem per-se ... but border switches (the ones that VLAN-unaware devices are connected to) have to be VLAN-capable.

@xvo: you managed to miss the point with the second paragraph ... OP wrote that the isolated devices need internet access, so firewall filter dropping packets from those devices toward WAN interface is exactly the opposite of what OP wants.

@xvo: you managed to miss the point with the second paragraph ... OP wrote that the isolated devices need internet access, so firewall filter dropping packets from those devices toward WAN interface is exactly the opposite of what OP wants.

There was a second part of the question in the initial post, that I was answering with this, but I guess it was scratched out while I was typing

Quick question, what if the IP addresses are assigned statically.
Could one not make individual FW rules for each??

Source (badip) allow to internet
Source (badIP) destination !badIP reject.

hmmm I keep forgetting this will not stop layer 2 traffic within a subnet)
- dum switches will connect devices regardless of layer 3 rules

There was a second part of the question in the initial post, that I was answering with this, but I guess it was scratched out while I was typing

yeah, sorry, I decided to address one issue at a time and figured another one myself anyway

When it is not possible to arrange that, first replace your switches with VLAN-capable switches.

thanks everyone for answers. I think I will generally move towards this direction. All other ways would be too messy and it's not worth the effort. All I wanted is to just isolate wi-fi clients from interacting with LAN, but whatever, all resources are under passwords anyway and should be safe. Unless another thing like eternalblue suddenly comes

Quick question, what if the IP addresses are assigned statically.
Could one not make individual FW rules for each??

Source (badip) allow to internet
Source (badIP) destination !badIP reject.

hmmm I keep forgetting this will not stop layer 2 traffic within a subnet)
- dum switches will connect devices regardless of layer 3 rules

Why is that a problem? Layer-2 traffic is not an enormous security-risk, I'd say, if your device is not exploited or infected yet, there will not be anything other than static IP access opted for exploits in the first place. Assuming your LAN is entirely audited and clean, how would you see a scenario where a restricted/blocked LAN IP would be exploited just using MAC or something else? Especially from outside of the LAN, so having to bypass firewalling (plus NAT), there are no open ports to the badip devices from the WAN. And DNS requests are done through a local server too (pihole with unbound for example)..