> In a word - yes!  Each interface should be in its own broadcast domain 
> -
> what you've been trying to configure is two interfaces in the same
> broadcast domain - how could m0n0wall know which interface to route a
> packet to?

I thought so. :-)

> Now if you only have a need for two 'LAN' interfaces then you could
> bridge them together.  Enable filtered bridge and then you can control
> what traffic passes between the two 'LAN' interfaces.

That does work. I had that running.....But I was wanting to use Captive 
portal on the LAN side....so I can't do that if I bridge them.

But it's OK. I can just run them all on separate subnets and use radius.

-- 
Regards,
Richard St Clair,
Co-Founder & Internet Evangelist,
Internet Users Society Niue,
--------------------------------------------
"To Provide Internet Access to Undeveloped Areas of the World"