Here is a AP configuration :
On console :
Configure a ssid on wlan00 with encryption (private use)
Configure a ssid on wlan01 with plain text for captive portal.
On Zeroshell web gui :
eth0 and wlan0 (private wifi) on a bridge on same network than your wired network.
Bridge0 on 192.168.0.243 so i connect zeroshell here.
NAT on bridge0
Wlan0 will have IP from box DHCP on private network.
Wlan1 on 192.168.1.243 (public wifi on captive portal)
Zeroshell dhcp deliver on 192.168.1.0 on .0.1 to .0.150 for example
Default gateway on 192.168.0.243
DNS where you want
captive portal configured on wlan1
Firewall rule to blocl .1.0 to go on 0.0 :
1 WLAN01 * DROP all opt — in WLAN01 out * 192.168.1.0/24 -> 0.0.0.0/0 destination IP range 192.168.0.1-192.168.0.253
Just drop all packet to go between 192.168.0.1 to 192.168.0.253 (192.168.0.254 is my gateway internet box)
Enjoy !