Make sure the following steps are done :
In the Network profile that is selected for guest ssid , make sure the following is selected.
The selection will come from Profiles > Network Interfaces.
Here, the important part is the following :
1. LAN to WAN forwarding
2. Enable NAT is selected which makes sure Masquerading happens.
----
Next step to check is whether the NAT'ed ip is whitelisted on the firewall side.
For the same, try the following :
This will make sure that the DNS is working fine and general internet access is allowed to the routed ip.