Just firewall the wireless LAN off from everything else, and terminate the WLAN VPN in a DMZ. Cisco's VPN concentrator seems to work pretty well. Typically use either IPSec or RADIUS with SecuRemote tokens.

May not be cost effective for small installations...
_________________________
Rory
MkIIa, blue lit buttons, memory upgrade, 1Tb in Subaru Forester STi
MkII, 240Gb in Mark Lord dock
MkII, 80Gb SSD in dock