Since you don’t mention your router’s make and model, here’s the general idea: A consumer-grade router generally consists of a “WAN” port and a number of “LAN” ports. Most cheap router SoCs have two integrated network interfaces, one for WAN and one for LAN. Of course that doesn’t match up with the number of LAN ports—there’s a built-in switch.
In most routers, these switches are in fact programmable. They can do port-based VLANs and VLAN tagging. That means you can create a “physically separated“ network interface.
Usually it’s like this:
+-------------+ +--------------+
| CPU | | LAN1 |--
--| WAN LAN |--| Switch LAN2 |--
+-------------+ | LAN3 |--
+--------------+
Whatever is connected at LAN1 (where your router Y is connected) has full access to LAN2 and LAN3.
However, we can reconfigure the switch and create two VLANs:
+---------------+ +--------------+
| CPU | | Switch |
| LAN.1 |--| VLAN1 LAN1 |--
--| WAN | +--------------+
| LAN.2 |--| VLAN2 LAN2 |--
+---------------+ | LAN3 |--
+--------------+
After setting everything up, each VLAN will appear as a separate network interface to the system. Because LAN1 is no longer on the same broadcast domain with LAN2/3, the OS receives the traffic and can decide whether to forward packets from VLAN1 to VLAN2.
To avoid confusion, you’d usually pick a different subnet for different VLANs, so the router really has to route. :)
Whether Tomato can do that, I do not know. OpenWrt can, and IIRC so can DD-WRT. It’s essentially a wired guest network.
If you can’t provide that level of isolation, you need to try and filter on router Y, using rules somewhat like these:
iptables -A FORWARD -d 192.168.0.0/16 -j DROP
iptables -A FORWARD -d 172.16.0.0/12 -j DROP
iptables -A FORWARD -d 10.0.0.0/8 -j DROP
That of course relies on router Y to enforce the policy you desire.
iptables -I INPUT -d 192.168.19.0/24 -j DROP
iptables -I INPUT -d 192.168.22.0/24 -j DROP
oriptables -I FORWARD -d 192.168.19.0/24 -j DROP
iptables -I FORWARD -d 192.168.22.0/24 -j DROP