I have one wireless interface (wlan1) and one virtual AP (vap1) on that interface.
I have a hotspot setup on each of these, hs1 on wlan1, and hs2 on vap1.
Both are configured the same except for the IP stuff (different subnets).
Problem is that the hotspot on vap1 doesn't work at all. No redirect to the hotspot login page, and trying to ping the router returns a dest net unreachable error (which I see is from the dynamic firewall filter chain hs-unauth).
It seems traffic coming in vap1 is not matching the "from-client" check in the dynamic filters. Anyone else see this? If not, how did you get a hotspot running on a virtual AP interface?