Router – Netgear Router/Modem installation PPPoA NAT issues

You are right to not want to run multiple DHCP servers on the same network, that can end up giving very random results.

Right now it sounds like you have both wireless routers plugged into your main router by their internal ports, using them basically as access points instead of routers (just getting the wireless users connected into the main network and letting the main router do the real thinking).

If the wireless router the students are on allows you to setup your port blocking rules to specific addresses, you may be able to on that one set it to block all communication, then allow specific rules to your internal servers. Then connect that router to your main network by the Internet/WAN port on the router and enable DHCP on it. That will make it so that the students are segmented on their own network and can only access your main network routing through the wireless router, which has the rules setup on it.

So, you would have:
Internet Connection <-> Main Router WAN Port
Main Router Internal Port <-> Teacher Wireless Router Internal Port
Main Router Internal Port <-> Student Wireless Router WAN Port

Anyone connected to the main router or the teacher wireless will be in one network and have normal access. Anyone connected to the student wireless will be in another network behind the student wireless router and be subjected to the rules setup on that router.

Otherwise, you'd want to look into setting up a DMZ to separate the students from everyone else, then setup your specific rules they are allowed to do. Your current equipment may not support this, your main wired router would be the one to look at.

I presume that you have already worked with the ISP and are convinced that it isn't the DSL line or the equipment on their side. If not, I would start THERE. You will spend a bunch of time on the phone, but if the problem is ISP related it will take a while to get fixed, so you should start now. It will likely take a bunch of outages for them to admit the problem, because they close problems if an equipment reset fixes it.

I would obtain (buy or badger the ISP) a replacement DSL modem and see if that fixes the problem. If it does, you're done. If it doesn't, reset the DSL modem to factory settings and return it, because the problem is the WatchGuard.

If you need to replace the WatchGuard (and it isn't under warranty or service), I recommend Astaro. $1000 will get you a great firewall appliance for a small office.

You can also test the WatchGuard directly. If you can put up with some internet downtime, replace it with a standalone PC. Or if your firewall config is simple, get a free trial from Astaro. If the connection remains alive long enough (say three or four times the typical time to failure) then you know the WatchGuard was the problem.

Note #1: You don't need to do these serially, you can move forward on all three at the same time.

Note #2: You can build a great firewall on the cheap with a PC with multiple NICs and something like FS-Security or SmoothWall, but I wouldn't unless you are into rolling your own stuff or are horribly strapped for cash.