We have a 2820n and have a working VPN to the main office. In the shop we would like to run a cyber cafe service. I have on the ssid ticked isolate LAN and member and this works okm the problem is they can still access the VPN tunnel.
Is there anyway to isolate the wireless from the VPN, i suspect it will be subnets but am new to setting up these things

Shop Router
10.100.20.1
255.255.255.0

Shop DHCP
10.100.20.20 - 10.100.20.50

VPN to office

10.100.20.0/24 == 10.100.10.0/24

I think I need to change the subnets so that only the address below 10.100.20.20 can access the tunnel but don't now how.