Help me setup a guest wireless with a second router off Time Warner Cable.

I volunteer at a local church and am trying to setup a guest wireless network off the private Time Warner church network.

The church network is 192.168.67.1 range and the subnet mask 255.255.255.0
It is an Arris Cable modem suplied by Time Waner. It has wireless built in and that what i'm using as the Church's private network.

I attached a Linksys WRT54GL router to the output port of one of the Arris cable modem ports to the WLAN in on the Linksys and setup the Linksys Router to host a guest network. I tried different private IP ranges. 10.1.1.1 and subnet mask 255.0.0.0 etc. But I can sill access the Church's private network (shares, RDP) by servername or IP. The severs are locked down, and accounts are used for everything with lockoutpolicies, so it is unlickely that somebody would mess with anything - it is a church afterall, but I'd rather the two networks be distinct and the guest network not be able to reach the private network. I tried the AP Isolation setting, but could still access the private network. I tried downloading Tomato firware but the same problem occurred.

What option am I looking for on the routers to disable network traffic between the IP ranges?

I haven't tried making the Arris the guest wireless, and the Linksys the private network. That might be another thing to try, but I'd rather the faster service, and more reliable connection go to the Church private network.

What is the trick/setting to make this work?

Plug the ethernet cable from the TWC modem into the WAN port of the Linksys.

I did.

from my OP.
"I attached a Linksys WRT54GL router to the output port of one of the Arris cable modem ports to the WLAN in on the Linksys and setup the Linksys Router to host a guest network."

I guest that is confusing... ---- reworded for clarity.

I attached one of the Arris cable modem ethernet ports to the WLAN in on the Linksys and setup the Linksys Router to host a guest network.

Guest wireless works through the linksys, the internet works, I just want to logically seperate the two network spaces to prevent access of the guest to the private network.