Question : WiFi Access Point & Domain Network

Hello,

I am in the process of straightening out the wiring on our switches and came accross an interesting problem with our wifi access points.  Our network consists of 200 workstations, 10 laptops, 10 servers, 8 switches, 1 firewall, 2 wifi routers, and a handful of iPhones.

Prior to making any changes, everything was working as intended (albeit the wrong way).  Here is a simple ascii diagram of how things were previously working:

[DEMARC] ==> [ISP GATEWAY] ==> [NETWORK SWITCH1] ==> [DLINK DFL FIREWALL (wan1)]
then
[DLINK DFL FIREWALL (lan1)]==>[NETWORK SWITCH4]

All servers were connected to switch 1, and workstations/wifi access points to other switches.  This particular setup allowed all network stations to be configured with domain settings (172.16.1.X) and forced to use the network DNS servers.  The wifi routers were configured on the wifi LAN side with 192.168.3.X and on the static IP side with 67.50.92.X, subnet mask 225.255.255.224, and gateway 67.50.92.161.  This allowed wifi devices to connect to unfiltered DNS servers.

Anyhow, long story short - I have corrected the wiring to look like this:

DEMARC] ==> [ISP GATEWAY] ==> [DLINK DFL FIREWALL (wan1)] ==>  [DLINK DFL FIREWALL (lan1)]==>[NETWORK SWITCH1]

With that change, now both wifi access points provide access to the LAN side of them (192.168.3.X), however provide NO internet connectivity with the public IP settings from our ISP.

I have tried multiple things to get the wifi points back online with unfiltered internet access.  So far they are working when I changed the wifi router WAN settings to exist on our domain network (172.16.1.X), however the openDNS filtering is now applying to connectivity.

Any ideas or suggestions would be GREATLY appreciated.  The DLINK DFL800 doesn't have the most intuitive interface either :(

Answer : WiFi Access Point & Domain Network

Solution:

Use an unmanaged switch to segment the connection from the gateway.  Publish public IPs to WAN1, WAN2 and the DMZ.  Connect each subnet into appropriate port.