how to setup guest network separate from internal LAN/server

I'm still pretty new to Tomato, and am trying to read and learn, but I'm stuck with something that feels pretty basic.

I have an e3000 flashed with Tomato Firmware v1.28.7503 MIPSR2Toastman-RT K26 USB VLAN-VPN-NOCAT

I'm connected to a DSL modem from TelMex in Mexico. It also serves as a router, including wireless.

I want to setup the modem to accept connections from guests, and keep them separate from my internal LAN/computers.

I want to have all my internal computers connect to...

how to setup guest network separate from internal LAN/server