[SOCALWUG] Firewall separating wireless vs internal users

[John Freeman]

Can anyone give me some ideas or directions on this situation:

In a small wired office environment, is it possible to add a wireless router AND guarantee that any wireless Internet users do NOT have any access whatsoever to the internal LAN and PC's on the internal Lan?

It seems to me that the wireless users would have IP addresses of the same subnet as the office users, and hence the office LAN would be vulnerable, and basically unsecured.  Both would have Internet access.

Maybe this is an idea?  WAN==> Wireless Router ==> Firewall ==> switch ==> internal PC's ?

Not trying to spend a fortune, but I think just getting a wireless router and "hoping" no one discovers the office network is a mistake.

Ideas?  Thanks,

John Freeman