Enable Client Isolation
- Deny Inter User Bridging
- Deny Intra VLAN Traffic
On "Inter VLAN Traffic Whitelist" Configure the ChromeCast Proxy IP
Setup a Network-based Access Rules for the Wireless config:
Allow Any on server "gateway IP"
Allow Any on server "ChromeCast Proxy IP"
Deny Any to network "guest-network/mask"
Allow Any to all destinations
With these settings you should be able to only see the Gateway and ChromeCast Proxy, but still block all other devices on the network.
It is assumed that you have the ChromeCast Proxy in two networks. All ChromeCasts are connected to a hidden encrypted network that terminates on the ChromeCast proxy, and there is a second IP that is on the same subnet as the Guest WiFi (this is the whitelisted one).