Firewall/NAT

Hi all,

I have just purchased two m0n0walls to run one of our satellite offices with the following functions:

m0n0wall 1:
eth0 - Untrust (goes to a switch that goes to our fiber connection to the internet),
eth1 - clients (goes to all ethernet connected office pc's),
eth2 - admin (enables us to access the m0n0wall via our WAN for remote admin),

m0n0wall 2:
eth0 - Untrust (goes to a switch that goes to our fiber connection to the internet),
eth1 - Wireless (captive portal based, free wifi service to clients/ visitors/ staff on site),
eth2 - admin (enables us to access the m0n0wall via our WAN for remote admin),

From time to time, there may be a need for users on our unprotected wireless service (m0n0wall 2) to access their desktop pc's (m0n0wall 1), and as such there needs to be a firewall policy in place to allow this to happen.

Is this possible? and if so what would be the best practice to achieve? (I was thinking using the switch that connects both m0n0walls to the internet and make a firewall rule to enable traffic between the two internally).

Many thanks in advance!