Every time i start to think about similar architecture I start thinink why nobody come with idea that to add Wi-Fi support dump pipe mode (direct L2 mode if i'm right) and all security/packet droping handled by higher layer; like direct OpenVPN packets on air and everything handled by software. Ofcourse it will hurt some performance but security you can have few sacrifices.