I reply myself. I made it work by using MAC ACL's: on the swichports where the 3 ONT's are connected, put a MAC ACL that allows only the MAC of the router interface. BR
Hi guys,  I've been several days struggling with a configuration that I'm not able to make work. First of all, I'm using a Dell N2048 switch with the latest firmware version.  I have 3 ONT's connected to the switch, on ports 1/0/1, 1/0/2 and 1/0/3. These ports are in trunk mode, allowed VLAN's 2, 3 and 6; this is because the ISP works like this, VLAN 6 is for internet, VLAN 2 for IPTV and so on.  On the other side I have 3 interfaces of  my router connected to switch ports 1/0/10, 1/0/11 and 1/0/12, all these three in mode access VLAN 6. The thing is that I need to isolate the things because when the router starts a PPPOE session it uses a random (and wrong) ONT because the 3 ONT's are in the same VLAN (6).    In other words, I need to link only port 1/0/1 with port 1/0/10 in the way that the router can't see the other ONT's (even when they are in the same VLAN 6). I've gone crazy reading abut VLAN Q-in-Q, Private VLANs and protected ports, but haven't been able to understand the way to achieve this.  Any help will be much appreciated.  Thanks    
Need help with PVLAN's / Protected ports