Help with shield router

Running a peer network.
Presently router 1 configured
lan 192.168.254.x
wan 192.168.1.x
isp gateway 192.168.1.254 (the dsl modem)
primary dns 192.168.1.254 (also the modem)

I want to add a second router, the first router to become the shield router.
the second router will connect to the modem, and a wireless access point
This will shield the original network from anyone accessing the WAP.
What settings do I want on router 2 (are the modem and wap on lan ports)?
On router 1 wan
IP router 2 or modem or just on that net 192.168.1.x
isp gateway router 1 or modem or other
primary dns modem or other
The modem is dynamic ip