We have a VLAN that we want isolated from the rest of the network (hosts on this VLAN can only talk to hosts on same VLAN). The problem is, we also want DHCP on this VLAN (traffic should get out of that VLAN just to get DHCP addresses from our server...