Captive Portal on a wireless router connected to Opnsense device

[kss]

I have finally got Opnsense configured just right for our needs -- It is a two-port repurposed PC with an Intel core I5, which works very well. I also got the Guest WiFi working by installing an internal atheros wireless card in the Opnsense PC and following the Captive Portal how-to. But this does not give me the bridged private WLAN that I need.

Now, I am trying to use a separate wireless router (ASUS RT-AC68U running Tomato Shibby) as an access point as well as guest wifi. Following the excellent tutorial, I have the bridged WiFi working for reliable private WLAN functionality.

However, I cannot get the Guest access point working -- I think it is because of the double NAT that is happening, once on the Opnsense box and again in the wireless router.

Can someone point out how to use an external router as a private LAN as well as a captive portal without running into double-NAT?  Thanks.