In uk.d-i-y, Andrew Gabriel wrote:
My WAP isn't on my LAN -- it is separately firewalled off
from both LAN and WAN.

One has to wonder what it can "access", in that case. :-)

My setup doesn't sound as highly segregated as yours but I think we both
have the same thought: Don't give wireless clients access to anything
they don't need access to.

My WAP is on its own LAN connected to the Internet via a NAT router[*].
My other PCs are on another LAN, which plugs into the first LAN through
a wired NAT router. So wireless clients can't access the wired PCs, only
the Internet.

Actually it's a bit more complicated than that, but never mind the
details. It's considerably better than the usual single-LAN setup.

[*] A combined router/WAP would be an obvious simplification but the
ADSL line comes in at the edge of the house (obviously) and the WAP
works best in the middle of the house (ditto).

--
Mike Barnes