If I'm understanding your situation correctly, you have a Linux box connected to your LAN, which is NOT serving as the router. That Linux box has two Ethernet interfaces, one going to the LAN, and one going directly to the WiFi appliance.
You can't really filter on the "gateway IP" because in typical cases, the only thing the gateway IP gets used for is to resolve via ARP what the MAC address of the gateway is. The packet is sent to that MAC address but its actual destination IP does not change within the LAN. Your router is doing the work of NAT; taking the source IP of say 10.0.0.1 and converting it into the public facing IP, and vice-versa.
You also can't filter based on destination MAC address, because this happens after iptables has finished filtering/routing/mangling/etc. That happens immediately before packet egress and happens at the data-link layer (Ethernet) which is lower than the network layer (the raw IP protocol).
It may not be the most ideal situation, but you may want to look into IP sets. This is a netfilter feature that lets you define a series of IP addresses, or ranges, and then match them all with a single iptables rule. It saves you the effort of having to mess with iptables, and also lets you add or remove subnets from the rule blocking LAN access without even touching iptables.
ipset create lan-block hash:net # Create an ipset called 'lan-block' that will store network/mask pairs.
ipset add lan-block 192.168.1.0/24 # add 192.168.1.0-192.168.1.255 to this set
ipset add lan-block 172.16.0.0/16 # add 172.16.0.0-172.16.255.255 to this set
ipset add lan-block 10.0.0.0/15 # add 10.0.0.0-10.1.255.255 to this set
iptables -A FORWARD -m set --match-set lan-block src,dst -j DROP # block all packets whose source or destination is found in the set lan-block.
See the man pages for ipset and iptables-extensions for more info.
On some distros ipset is not included, but you should be able to get it from your distro's repositories.
Hope this helps.