OK... Site is going to have 1 RB450G for router/firewall/hotspot/vlans, etc. Im going to have 4 411s w/ a single card in them for APs to cover all the area. 2 SSIDs on 411s w/ VLANs, etc. 1 network private and encrypted, 1 network for hotspot. For the hotspot SSID, I normally disable default forward to keep the clients from seeing each other on the network. How can I accomplish this with 4 APs and clients on the same subnet?

Bridge firewall? Ive never played with it before, so I dont exactly know what to do... Im sure it would just be 1 or 2 filter rules.