гостевой vlan, инет без локалки.

acl для catalyst:

access-list 2001 permit udp 192.168.254.0 0.0.0.255 host 192.168.22.22 eq 
domain
access-list 2001 permit udp 192.168.254.0 0.0.0.255 host 192.168.22.22 eq ntp
access-list 2001 permit tcp 192.168.254.0 0.0.0.255 host 192.168.22.22 eq 123
access-list 2001 permit udp host 0.0.0.0 any eq bootps
access-list 2001 deny   ip 192.168.254.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 2001 permit ip 192.168.254.0 0.0.0.255 any