Dual LANs sharing one WAN connection with pinholes between the LANs

Hi,

We have an existing LAN (LAN-1) which is already WAN connected using a standard residential router. We want to set up a new part of our network (LAN-2?) that is self-contained which will share the already existing WAN connection.

Users/computers on LAN-2 should in general not be able to detect or access the LAN-1 devices.

However, the network backup devices are on LAN-1 only, so I would like to be able to allow some pinhole access from LAN-2 to the NAS boxes on LAN-1, preferably on a privileged user basis, but it could also be on a privileged machine basis.

All clients will be Windows XP or Vista.

What sort of additional networking equipment would be required to accomplish this?

Thanks,
Sunday Afternoon