First, a disclaimer: I know next to nothing… so don't take anything I write too literally… I may sound like I know, but I really don't.
LinkSys' E3000 offers a separate SSID for guests where they can have access to the internet without having access to one's local network. The subnet is different.
When guests connect, they are met with a webpage asking for the guest access password. Kind of like when you go to hotels.
LinkSys' implementation is, IMHO, flawed in that they do not support setup of Guest access via the router's built-in GUI. Instead, one has to use their external setup application that, in a word, is less than convenient.
If somebody could implement the management of Guest access within the paradigm of the existing Tomato GUI, I think it would be a significant addition to an already-superior product.
If anybody wants some legwork done on this, tell me what you want and I'll get on it.