I've seen options where LAN clients get the same protection from WLAN as from WAN, ie the wireless is "untrusted" - I suspect LAN to WAN traffic is allowed but not vice versa.
Your point about isolation got me looking again at the Brightbox configuration pages. In their advanced page for Channel and SSID there are settings for "VLAN binding". The help file says this:
"Multiple SSID
The router supports up to 3 wireless network names (SSIDs). Typically you may like to use multiple SSIDs for one of the purposes below:
SSID1 is for your personal use, SSID2 is for family members and SSID3 is for guest access
SSID1 is for WPA security using default router settings and SSID2 is for older wireless adaptors that need to use WEP
In conjunction with VLAN binding you can restrict access to your home network or use bandwidth control to restrict the amount of data a guest is allowed to use (see below).
VLAN Binding
VLAN binding gives you the ability to share your internet connection with friends or family, while allowing you to keep computers or storage devices on a separate home network.
A typical example would be to use SSID1 for your personal use, and then provide the wireless settings for SSID2 to a guest. By choosing VLAN2 for SSID2, the guest user would be on a separate internal network meaning that any shared computers or devices on your home network would not be visible."
Given your knowledge about isolation, does this suggest any further thoughts?
Thanks.