Yes. You can create an additional VLAN / subnet for management then restrict web admin access to that VLAN. You can present the VLAN on a physical LAN port or on a new dedicated SSID.
1. Create a new Management subnet
Web admin>Network>Network Settings>new LAN
Here we create 192.168.200.1/30 named Management which will become the only subnet allowed to access the router’s web admin GUI:
2. Link new subnet to LAN port or SSID
Step 2 is only necessary if you want to get router admin access from the LAN, you can either link the new subnet/VLAN to a LAN port, or alternatively, you can create a new SSID just for management access, if you want to gain web admin to the router via IC2 then it is not necessary to link the Management VLAN to a LAN port or SSID. removing local access in this way does allow improved security, especially if Incontrol is set up to authenticate with 2 factor authentication.
Web admin>Network>Port Settings
Assign an unused LAN port to the Management subnet, port type ‘Access’:
Alternatively, link the new management subnet to a new SSID, link the new SSID to management VLAN and set the security settings:
Web admin>AP>New SSID
3. Allow LAN access from the Management VLAN only
Web admin>System>Admin Security
Set ‘Allowed LAN Networks’ to ‘Management’.
Note: If the Admin Security page says ““This configuration is being managed by InControl” you will need to temporarily disable Incontrol Device Web Admin, shown below :
Lastly , re-enable Incontrol Device Web Admin and test.