Make sure the following steps are done :

In the Network profile that is selected for guest ssid , make sure the following is selected.

The selection will come from Profiles > Network Interfaces.

Here, the important part is  the following  : 

1. LAN to WAN forwarding

2. Enable NAT is selected which makes sure Masquerading happens.

—-

Next step to check is whether the NAT’ed ip is whitelisted on the firewall side.

For the same, try the following : 

This will make sure that the DNS is working fine and general internet access is allowed to the routed ip.