After trying hard with different setup i can't see the wood for the trees.

i want to have a lan 192.168.1 / 24 with dhcp enabled  (guest dirt laptops)

another lan 172.17 / 16 with static ips   (goodnet -my cool pcs)

on the same Interface (sis1)


i want to have a DMZ lan set up on sis2 192.168.35/24


both sis1 nets must have NAT to th world (which is done via WAN - sis0 
interface.
both sis1 nets must have DNS service forwarded by gateway.
both sis1 nets must not be bridged. they shall be isolated.

goodnet clients must have limited access to the dmz servers.

How do i do this?

(see also my wrp/vlan post a couple of hours ago)

your help is very much appreciated!

Thomas