InJoy Firewall includes NAT, you can also run more than one copy to create two subnet's but this is something I've not done for over 10 years and have no idea if Bitwise works version allows that (including in it's license).
With your x:\mptn\bin\setup.cmd file, you can add other routes without problems even without using InJoy but once more this is something I am very rusty with as it's been so long.
route -fh
arp -f
ifconfig lo 127.0.0.1
ifconfig lan0 192.168.0.1 netmask 255.255.255.0
dhcpstrt -i lan1 -d 0
ifconfig lan2 192.168.2.1 netmask 255.255.255.0
route add default 10.0.0.1 netmask 255.255.255.255 -hopcount 1
experiment with:-
==> route add -net xxx.xxx.xxx.xx netmask 255.255.255.255 -hopcount 1
or
==>route add -host 192.168.2.1 10.0.0.2
ie, you need to add a route from your second network to where you want the packets to go, also, hmm, no idea how it works with DHCPd

)
I would use static IP's as its easier to plan out on paper, then use InJoy's DHCPd module to hand out IP's if you need to for other devices.
Actually, come to think of it.. I think you can setup InJoy with a seperate range for it's DHCPd to the two static ranges ..
devices on lan0 would be effectively hidden from devices on lan2?
Assuming your routing has been setup correctly then yes, devices on LAN2 can be hidden from LAN1 but remember this is only on the software layer. Unless it is required I would setup your internet modem/router with a second internal IP if it has more than one ethernet port and physically separate the networks. Depends on what you wish to do like monitor via InJoy's GUI etc.
Hope I'm not confusing you, I'm getting old
