I used to work for a company that did wireless hotspots, and this is the challenge that was given to me one day. I don't believe there is a secure solution to it, but it still bugs me for some reason.
We wanted to ship a wireless hotspot device (an ALIX board running monowall) to a location where we don't know anything about the network, so we have no idea what IP addressing they are using, and be able to have a non technical user just plug it into their existing router and Just Work.
All the networks would be simple small office modem/NAT routers, so the hotspot can use DHCP on it's WAN side to connect to the internet. I pointed out that anyone on the hotspot could also access the office computers, since it considers that to just be another part of the internet. The hotspot is free and open wireless access for anyone in range - a lovely target for an attacker.
Try as I might, I couldn't find any way to solve it that I considered to be secure enough. In the end, I refused to set them up this way, and we had to go out and reconfigure things so our router connected before the office machines and could isolate the office network and the wireless clients. But the problem still bugs me from time to time.
So my question is, is there anyway to securely setup the network in the diagram below if you only have control of the hotspot device, and don't know anything about the rest of the network in advance?
For the purposes of this question, I'm not concerned with what people on the wireless can do to each other, or what they can do on the internet. The only concern is protecting the office PCs from people connected to the hotspot.