A home router shares one public address with every device behind it. Make the laptop reach the outside server, let the outside server reach the home web page through a forwarded port, and keep the guest network away from the home devices.
Make the laptop reach the outside server at 203.0.113.80 port 8080, and make the server see the router's address, 203.0.113.1, not the laptop's.
Make the outside server reach the home web server through 203.0.113.1:8080.
Make the guest unable to reach the home web server, while it can still reach the outside server.
Fix the router with commands only: sysctl, nft. Reset puts the faults back.
Checks
2 of 5 pass
✗The laptop reaches the outside server, which sees the router's addresslaptop connects to 203.0.113.80:8080: not reached
✗The outside server reaches the home web page through 203.0.113.1:8080server connects to 203.0.113.1:8080: not reached
✓The guest cannot reach the home web serverguest connects to 192.168.1.20:80: not reached
✗The guest still reaches the outside serverguest connects to 203.0.113.80:8080: not reached
✓An unforwarded port, 203.0.113.1:22, is refused at onceserver connects to 203.0.113.1:22: not reached
Stuck, or done and want to compare? Try it yourself first.
Type a command, for example ip addr, then press Enter. Type help for the list.
IPv4 only, one packet at a time, Linux behaviour (nftables, conntrack and iproute2 output from Ubuntu 24.04). Connections stay in the conntrack table; nothing times out. Port numbers on a clash are chosen by a fixed rule, not at random.