This situation is a variant of the commonly discussed "Separate WLAN and LAN" theme. WRT54GL router, Tomato 1.28, used only as an AP and switch. Ports are configured as follows (from Seiichiro's guide): VLAN0 = Ethernet ports 1-3 VLAN2 = Ethernet port 4 I want to bridge the WLAN to VLAN2 only, and isolate the WLAN from all other WAN/LAN ports. I don't need the router's internet/WAN port, DHCP server, or firewall as these functions are handled by other devices on the network. I do want to enable wireless security. Thank you for your suggestions, including the syntax of the scripts.