Question : Wireless security

I have an ethernet cable network which I want to connect a number of wireless access points or routers to.  The problem is each wireless user must authenticate to a squid proxy server for bandwidth quota management, so it is important that individual ip addresses are intact when they communicate with the proxy server.
Obviously it is straight forward and would work as mentioned above.  The problem that I am facing is I would PREFER to isolate the wireless users from the ethernet cable network.  But if I isolate them, then they can't communicate correctly with the proxy server.  For example, if I put all the wireless users on a router and then use NAT on each wireless device that connects to the ethernet network, I would get the security, but each wireless user would be seen as a single user once their IP goes through the wireless router.

So basically I am wondering what I could possibly do to isolate the wireless users, yet keep them on the same physical network?  Are there any wireless routers which could just route the traffic and not NAT it?

Answer : Wireless security

Just don't NAT at the router. Create a second subnet and assign it to a different interface on your router (if you have one available) then connect that new interface to your wireless network and use an ACL to keep the networks separate.

Or you could use private VLANs; but I don't know what kind of hardware you are running or if it supports them.