I am working on really locking down my wireless setup...what I would like to do is isolate the Wireless Router traffic from the rest of the LAN, and require a VPN or other secure connection from wireless -> LAN (and other VPNs, etc.). LAN is 192.168.1.0/255.255.255.0, RV042 has several different VPN tunnels to other sites, at 192.168.2.0, 192.168.3.0, and 192.168.4.0. I had the idea to designate the wireless router (it is an AirPort router, not just AP) as the DMZ Host (different from the DMZ Port) and set up some firewall rules as: 1) Allow DMZ Host -> RV042 PPTP via LAN (to allow a PPTP VPN connection from wireless clients to the RV042 on the LAN interface) 2) Deny DMZ Host -> 192.168.1.0 ~ 192.168.4.0 all traffic via LAN (deny any other traffic from DMZ Host to the LAN and VPNs on the LAN interface). While this setup does prevent wireless clients from getting to my other VPN tunnels (192.168.2.0, ~ 192.168.4.0), it does not prohibit traffic to/from the physical LAN (192.168.1.0). I am guessing this is some kind of built-in rule in the RV042 to guarantee that anything on the LAN always has access to the router? Or maybe I'm just doing it wrong. How does one go about locking down the DMZ Host better?