Guest network isolation is broken in 3.11.4 and 4b2
More info:
https://forum.turris.cz/t/guest-network-wi-fi-1-wi-fi-2-isolation-issue/10343/ https://forum.openwrt.org/t/client-isolation/13914/27
A workaround for v3.11.4 and 4.x (the latest one need kmod-br-netfilter to be installed)
echo 1 > /sys/class/net/br-guest_turris/bridge/nf_call_iptables
echo 1 > /sys/class/net/br-guest_turris/bridge/nf_call_ip6tables