In another life I wrote exactly such a mechanism. A little firewall here, a web server there, some stuff in between to turn on and off the firewall for a given IP address, and a default rule that redirects all port 80 traffic to a web server that has the login page. Easy as cake? Not really.
First, you can try looking at nocat, an open source project to do just this sort of thing.
Don't try to do it (write up a mechanism that does wireless authentication through a captive portal) yourself. It's a short road to crazy-town.
The simplest way to do it yourself is to run 2 sets of APs (if they're cheapo non-vlan, single ssid consumer APs). One set of APs is on a private network with a web server, a DHCP server and a DNS server that answers with the IP of the web server for all DNS lookups. Someone looks up google.com? They get 192.168.66.6. They look up snoopy.com? 192.168.66.6. They look up bobsyeruncle.net? 192.168.66.6. And on that web server, you put a web page that says "welcome to (insert company here)." "If you want to use the wireless network, change your ssid to "securenet", set it to "WPA2" and "eap-ttls" (or whatever wireless auth protocol you're using might be).
The other APs will, of course, be connected to the "wireless" interface on your firewall and allow whatever access you deem proper for wireless network access at your site.
Oh -- wait -- you're not using a pre-shared key, are you? If you are, you really don't have any wireless security at all. Once I know the key, I can spy on everyone's traffic. Even junky consumer APs these days support WPA-enterprise and radius, and you can use the radius server on windows and make wireless authentication work properly.
For that lesson, you'll need to put another quarter in the machine and ask another question...