Hi,
I had the same. You actually describe two problems: 1) The internal network is exposed/accessible from the hotspot network. 2) It actually points out the existance of said internal network to the users by the DNS.
For the DNS issue, its very simple: Change your hotspot router to non-DHCP/static IP address, so you add the IP/GW/DNS manually. And then simply add 8.8.8.8 and 8.8.4.4 as DNS, or any other DNS you would like to use, like those of your ISP. In DD-WRT go to Setup->Basic setup to do this.
For the exposed network, I added the following 2 lines to the firewall (on DD-WRT). The first line was already present from HotSpotSystem.
Go to Admin->Commands, type all 3 lines in the Command box, and ‘Save as Firewall’
iptables -t mangle -A POSTROUTING -p tcp –tcp-flags SYN,RST SYN -m tcpmss –mss 1412:65535 -j TCPMSS –clamp-mss-to-pmtu
iptables -t nat -A PREROUTING -p tcp -m state –state NEW -s `nvram get hotss_net` -d `nvram get wan_gateway`/24 -j DROP
iptables -t nat -A PREROUTING -p tcp -m state –state NEW -s `nvram get lan_ipaddr`/24 -d `nvram get wan_gateway`/24 -j DROP
The two extra lines drop any new TCP socket from the hotspot to the local LAN. But any new socket from local LAN toward the hotspot would still work, which is nice for management if you have extra AP’s behind the hotspot. It drops traffic from both the virtual networks (the 182 net) and the actual network (the 20 net) so even hackers who sniff out the 20 net cannot get past it.
I had expected to also have to add a line to again accept traffic to the gateway itself, as indeed originally the DNS on the gateway is used. But it seems somehow the gateway is already exempted in some other firewall rule. So with above lines, your internal network is blocked, except the main gateway, That is still ‘exposed’ make sure you set a good password. I suspect its better that way anyway, it could be that if you cannot get to the gateway, you also may not get past it. At least there are no hints to its existance.
I was testing this only yesterday evening, but it seems to work on DD-WRT at least. But be careful, a wrong firewall statement could make your device unaccessible, and you would have to do a master reset. I am not responsible. Let me know your result.