Problem --
I'm assuming here that you want to PREVENT wireless clients from accessing your wired LAN. (and vice-versa) While at the same time allowing both the LAN and the Wireless side to share the Internet.
Solution --
You get 2 routers. The second one can be a non-wireless router, it doesn't matter.
The first router with the wireless, you configure as you want your wireless to be available, connect it's Internet port to the modem.
The second router you configure for your own private LAN, shut off the wireless cabability on it if it has it. Setup DHCP etc.. as normal. Connect it's Internet port to one of the LAN ports on the first router.
(that will be the final config, you will likely want to plug them directly to a computer while you are configuring them though)
The idea here is you want it so the first router does not share the LAN IP address range of the 2nd router. You don't want devices on the first router to address devices on the second router like they could if they were all on the same LAN.
Suggested Settings --
router 1 --
wifi on, WPA2, Internet facing side --> auto-acquire IP and DNS, LAN facing side --> router ip = 192.168.0.1,netmask 255.255.255.0, DHCP Start 192.168.0.10, 25 IP's (or whatever you like), whatever security settings you want (eg web config port off, LAN only config, etc..),set the admin password, tape the password and wifi passcode to bottom of router.
router 2 --
wifi OFF, Internet facing side --> auto-acquire IP and DNS, LAN facing side --> router ip = 192.168.1.1, netmask 255.255.255.0, DHCP Start 192.168.1.10, 25 IP's (or whatever you like), security however, set the admin password, tape the password to the bottom of router.
Also on router 2, you want to set the IP range for router 1's LAN (minus the IP for router 1) to be dropped. (should be an IP filtering section)
So in this case router 1's range is 192.168.0.1 to 192.168.0.254, since 0.1 is the router's IP, you want to set 192.168.0.2 to 192.168.0.254 to be dropped. .0 and .255 are "broadcast" addresses.
Paranoia Setting --
On router 1 (this is a paranoia set-up, you're doubly insuring there will be no communications) -- repeat the blocking settings for router 1 also, blocking all of router 2's IP's. .1.2 to .1.254 to be dropped.
Note -- netmask helps efficiency, but not with the security issue. The blocking of each other's addresses is what stops the cross-over from wireless-LAN to wired-LAN and vice-versa.
This prevents all of the IP's from the wireless connection from reaching all of the IP's from the LAN section. (except the routers of course)
Hope this helps,
Roger Tiedemann, Jr.
www.rogertdj.com
www.crossloop.com/RogerTDJ