How to secure a WiFi network?
It seems like a simple question but I've thought about this for a while and have done quite a bit of Google searching. There's a LOT of hand-waving. I'd like to set up a wireless access point but lock it down with a better network topology (e.g. not have wifi running on the same subnet) and implement better security measures. I'm not adverse to buying additional hardware. Actually, I'm pretty sure I will have to buy more hardware to get it to work but it would be nice if I don't have to give up an arm or a leg to do it.
My experience with router equipment is the cheapo consumer-grade stuff with default firmware. A few months ago, I bricked a $20 router attempting to install Tomato on it while trying to branch out a bit.
Once upon a time, I saw a wifi network setup where each user had to have a signed SSL certificate to just join the wifi network in the first place. This was years ago and my memory is a bit rusty as to the specifics (or maybe I'm crazy and imagining things). I'd like to do something similar if possible but I don't know where to start. If possible, I also want to change access keys frequently and as painlessly as possible such as automatically deploy new SSL certificates every month to already connected devices and revoke the old certificates (and get a notification whenever this happens and for which devices).
I also want to set up a VPN tunnel for wifi to the internal network. I have no idea where to start for this either.
I also want to set up a logging and notification system on my new wifi network for whenever any device successfully joins. Again, no idea how to do this.
Basically, I'm looking for the magical words I need to search for on Google and a few good step-by-step tutorials that utilize good security practices and don't recommend things like "hide your SSID" that don't actually do anything.