Airport time capsule private network configuration

Question

I am trying to use the airport timecapsule in a very non-standard way, and struggling to get the configuration to work.  I need the ability to have the time capsule (airport router) stand alone, with NO connection to the Internet or other network source (no DHCP server on the WAN side).  I want to have a static IP for the WAN side, where I can define a compatible static IP on a laptop such that one laptop (possibly more in the future) is connected on the WAN side, and additional laptops are connected on the LAN side, and they can talk to each other.  Attempting to configure this in the Airport utility consistently gets me an error message that the router address is not compatible with the WAN IP address.
Can somebody share insight about the following configuration items under the Internet tab of the airport utility :
IPv4 address   (if I assign this 192.168.2.1 .... does that mean the WAN IP port on the time capsule has that IP address  ??)
Subnet mask  (does this apply to the LAN IP, WAN IP or both ??)
router address (If I assign this 192.168.1.1 I see impact in the network tab, where the DHCP address range is populated, so I am expecting this applies to the LAN side only ??)
Using the above values, I am NOT able to update the time capsule, it complains about IP address compatibility.
My goal is for the WAN side to be 192.168.2.x and the LAN side to be 192.168.1.x  ...... where the Airport Time Capsule is an "island" just serving that small population of hosts

Answer 1

I timed out for editing.. why Apple do you have 5min edit window.. would it hurt for 60min.. seesshhh..
Let me rephrase what I knew was right but could not explain.. There is the world of difference between a NAT router and a proper pro level router.
NAT routers do things one way.. it is designed to reach the internet from your LAN.. It uses a trick.. NAT.. ie address translation..
Many LAN Private IP addresses Masquerade as a single Public IP.
A proper router can route packets both ways between different domains/subnets/etc.
This is why incoming packets to your network have to be allowed in via port forwarding unless you have a link from internal request from a computer.
In other words people cannot access your file shares on your LAN without you opening the port forwarding and making it available.. whereas you can access any site on the internet and download files.
So back to your example..
You can access files on your server side LAPTOP plugged into the WAN side.. That is trivial and will work fine. You don't need ICS which I suggested.
And it means you can always access files one way.. so if you have one computer that you need to access many other computers.. The many others can be WAN and the one computer LAN.. (opposite to the way you think)..
Here. Try it yourself.. This works.
I plugged in a laptop and set it as 192.168.2.10 statically.
LAN side setup.
Right, plugged in a computer.. and it got the first available IP 192.168.1.2
From this computer I can ping across the NAT.. to the WAN port of the TC and the WAN computer.
ping 192.168.2.1
PING 192.168.2.1 (192.168.2.1): 56 data bytes
64 bytes from 192.168.2.1: icmp_seq=0 ttl=63 time=0.453 ms
64 bytes from 192.168.2.1: icmp_seq=1 ttl=63 time=0.763 ms
64 bytes from 192.168.2.1: icmp_seq=2 ttl=63 time=0.458 ms
64 bytes from 192.168.2.1: icmp_seq=3 ttl=63 time=0.355 ms
^C
--- 192.168.2.1 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.355/0.507/0.763/0.153 ms
minimeray-2:~ Ray$ ping 192.168.2.10
PING 192.168.2.10 (192.168.2.10): 56 data bytes
64 bytes from 192.168.2.10: icmp_seq=0 ttl=63 time=0.653 ms
64 bytes from 192.168.2.10: icmp_seq=1 ttl=63 time=0.752 ms
64 bytes from 192.168.2.10: icmp_seq=2 ttl=63 time=0.825 ms
64 bytes from 192.168.2.10: icmp_seq=3 ttl=63 time=0.861 ms
64 bytes from 192.168.2.10: icmp_seq=4 ttl=63 time=0.849 ms
64 bytes from 192.168.2.10: icmp_seq=5 ttl=63 time=0.862 ms
^C
--- 192.168.2.10 ping statistics ---
6 packets transmitted, 6 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.653/0.800/0.862/0.076 ms
But from WAN side I cannot reach the computer on LAN..
Ping from 192.168.2.10 failed to reach 192.168.1.1 (LAN side of the TC).. or 192.168.1.2 (computer plugged in)..
It still failed even though I set 192.168.1.2 as default server.. again this is not surprising as I would need to work a bit more.. but if I like ran HTML server from Mac on LAN, then I should be able to access it from WAN.. same as internet connected computer will work.. but you can only access the computer to which the ports have been mapped.
So why it doesn't work.. Because it is a NAT router.
How to get it working.. Buy a true router.. or a cheap router that runs third party like dd-wrt that offers gateway mode (NAT router) or true router mode..
See http://www.patrikdufresne.com/en/multiple-subnets-routing-with-dd-wrt/
Apple just do not build their routers with this flexibility...
And sorry .. I am getting old and the brain can take a day or two to click in.. that is why I experiment myself.. as soon as I tried I realised my mistake and why it won't work in exactly the way you want.. or at least I am assuming so.
It is relatively easy however to get multiple computers talking to each other from different LAN subnets.. just buy a managed switch.. these are cheap now for 8 port smart switch.. easy to set vlan with different subnets.