> bad config really. 
I don't think so.
One machine could serve a lot of services. We have IP and ports to 
magage them.
> 
> I would give the DNS and HTTP server a second IP address
> on a subinterface...and get the DNS to listen on that interface
I can do this but it is "not elegant" and make me a lot of mess in the 
network - I have to make changes on all PC on network.
Good network have centralized management.

I think about something like "walled garden" - to make special policy for 
unauth user, when we have captive portal enabled.
with future:
-Pass-through macs
-"normal" fw rules for unauth users. (not only allow IPs)

Do somebody know how to do this????