DNSMasq
interface=br1
dhcp-option=br1,3,192.168.5.1
dhcp-range=br1,192.168.5.120,192.168.5.170,255.255.255.0,24h

Firewall Script
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT 
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
iptables -I FORWARD -i br0 -o br1 -j logdrop 
iptables -I FORWARD -i br1 -o br0 -j logdrop 
iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset 
iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset 
iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset 
iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset

With enhanced restrictions
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
iptables -I FORWARD -i br1 -o `get_wanface` -j DROP
iptables -I FORWARD -i br1 -d `nvram get wan_ipaddr`/`nvram get wan_netmask` -m state --state NEW -j DROP
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT