TCP/IP routing: accessing a LAN device with wrong static IP configuration

It is your lan's business to protect itself from your wireless router, not your wireless router's job to protect your lan.

Depending on the size of your site --

hang the AP off of an interface on your firewall

configure an isolated vlan and connect the APs to that vlan, then connect that vlan to your firewall.

Now, configure your firewall to allow that network to access the internet but not the internal network.

Lastly, if you don't want to set that up, go buy yourself a netscreen 5gt-221 with wireless built in. Later, if you decide you need more APs, you can connect those to an interface on the netscreen.

Since they are different networks, you can just set up Source Based Routing using Policy based routing to route out different interfaces based on the source IP address of the outgoing packet.

For Cisco IOS is is basically the following (I think, untested) (F0/0 is the internal interface, 12.12.12.12, and 13.13.13.13 are your two IP gateways, you have two LANs 192.168.0.0/16 and 10.0.0.0/8):

interface FastEthernet0/0
     ip policy route-map foo-out

route-map foo-out permit 10
 match ip address match-foo-out
 set ip next-hop 12.12.12.12

route-map foo-out permit 11
 match ip address match-foo2-out
 set ip next-hop 13.13.13.13

ip access-list extended match-foo-out
 deny   ip 10.0.0.0 0.255.255.255 any
 permit ip 192.168.0.0 0.0.255.255 any


ip access-list extended match-foo2-out
 deny   ip 192.168.0.0 0.0.255.255 any
 permit ip 10.0.0.0 0.255.255.255 any

If these are just Frame-Relay then set interface instead of next hope would be okay as well.

For your inter-company communication, you wouldn't really have to do anything but change those acls so they deny source and dest where it is the same company, ie: deny ip 192.168.0.0 0.0.255.255 10.0.0.0 0.255.255.255. Also if these are two lan interfaces maybe a different route map for each interface makes more sense or is required, this is just meant to be an example to push you in the right direction, hopefully :-)