Gone in 1800 seconds

A tip: Set up the IPs statically and leave the DHCP switced on, only ban all addresses the DHCP will provide. Couple this with WPA and MAC address filtering and it might take up to half an hour for the hacker to get in :)

Or alternatively set up the Wifi so that it only routes to your VPN server. Or better still both :-)

What do you mean that most home users don't have a VPN server?