You've got a couple of things wrong ..
The interface eth1 shows as a LAN, but you've got it defined as the WAN interface in your traffic control
Also, your DNS forwarder should be listening on switch0 and eth1. It SHOULD NOT be listening on eth0.
Make those changes, and you should be golden.
The dashboard only showing traffic for the "switch0" interface for switched ports is normal.
Far as keeping the hotspot from touching your LAN, a simple firewall will do it.
firewall {
name eth1_in {
default-action accept
description "Block t-mobile from LAN"
rule 1 {
action accept
description "Accept est / rel"
state {
established enable
related enable
}
}
rule 2 {
action drop
description "Protect LAN1"
destination {
address 192.168.3.0/24
}
}
}
}Also, may be a good idea to duplicate "WAN_LOCAL" (name it "eth1_local") and then only allow DNS and DHCP requests (port 53 and 67 tcp / udp) to be sent to the router from eth1.
