I have a Linux box that am using as a router. The box's 'WAN' connection is actually another LAN (the primary LAN). I am trying to use my box/router to create another LAN (the secondary LAN). The purpose of the secondary LAN is to isolate a section of the network from the primary LAN. When I say isolate, I mean any network discovery protocols (bonjour, whatever windows uses, and anything else that uses the broadcast address) would not extend outside of the secondary LAN and any traffic between devices in the secondary LAN would never pass into the primary LAN. The main issue is that I need one-to-one NAT between the primary and secondary LANs, also in such a way that MAC addresses are passed through the NAT.
Ideally, I would have three lists of MAC addresses. Devices on the first list would be treated as described above. Devices on the second list would not be able to connect to anything outside the secondary LAN (my printer). Devices on the third list would effectively be only in the primary LAN (as if they were connected directly and only to the same WAN port).
1) How do I create a one-to-one NAT?
2) How do I pass MAC addresses through that NAT?
3) (Less important) How do I set up different routing rules dependent on MAC address as described in the second paragraph?