Using Airport Express on separate subnet to make isolated Guest Network?

Question

Hi. I've done a search here, I've tried setting this up at my house but haven't figured it out yet.
Friends have Verizon FiOS service. They're using the provided modem as the ethernet router and it is handing out DHCP addresses, and for a number of reasons including their home theater, on demand use, etc., they want to keep the FiOS modem as the router, not an Apple product.
We're using an Airport Extreme and a Time Capsule both in bridge mode to distribute the wireless network and everything works fine. They'd like to add an isolated, unencrypted Guest Network. I know we can't use the Extreme's Guest tab because we're in bridge mode.
But we do have a new Airport Express. It seems like there would be a way to set up a Double NAT on a different subnet and give guest users access to the internet but not to computers, shared volumes, printers, and everything else on the primary, encrypted network.
Is there a way to do this or will every address coming from the FiOS router be on the same subnet? Are there any other horrible consequences from doing this, i.e., the primary network will still operate fine?
If the DHCP range coming from the FiOS router is 192.168.15.001 to 192.168.15.199, do I set the Airport Express IP address manually? To what?
To eliminate the possibility of duplicate IP addresses would you have the Airport Express hand out a small range of IPs on a completely different network area, like 10.0.1.1?
Any other suggestions? Thank you.

Answer 1

I was trying to create a primary and guest network division after the router... such as an unusual configuration in the AEBSn after the FiOS router.
At my home I have my cable modem connected to an AEBSn, which is doing my network's routing. But I didn't set a Guest Network on this AEBSn. I am trying to set up a discrete Guest Network downline from this router. (Which would simulate my friend's installation where they're using a FiOS modem/router all in one and we want to create a discrete Guest Network after that.)
But as I guess you've been patiently trying to get through to me, Bob, whatever outlying separation you may be able to create seems to get put back together at the main router.
For example, today I connected a second AEBSn ("AEBSn Guest") to the LAN port of my primary AEBSn router. I set the AEBSn Guest to create a wireless network, and I set that to be a closed encrypted network called "Test," and I enabled unencrypted Guest Networking as usual and told the AEBSn to ignore the Double NAT error.
With this configuration I am able to get on the open Guest SSID, and internet connection is normal. Between the Guest and the primary encrypted network, printing is broken, iPhoto sharing is broken, and so on, but I still see shared volumes and can log in with authentication.
So I can see why a solution to this may have been elusive.
I don't know much about cable TV's subscription services but I took a peek at the set up pages of the Verizon FiOS router and noted there was a lot going on there. Lots of ethernet and cable IP addresses to Set Top Boxes, etc. Not sure if all this could be recreated within the administration of the Airport Extreme, but I am hesitant to risk messing up the Comcast services which are presently working well.
In terms of zooming out to the big picture... when I invite guests to share my internet service, they're usually doing email and web browsing for the weekend but at the end of their stay they want to print their boarding passes... so despite setting up a guest network I might end up giving them access to the main network anyway.
Thanks for the help, Bob.