My question would be similiar/equal to How to secure an open wifi access point
I do understand that an insecure public hotspot is exactly that, insecure (at least from the user perspective).
However given the limits of physical access and a reasonable amount of additional configuration/security measures one could argue that it should be possible to make the Wifi AP itself (the OS) secure from whatever their users do.
My question would focus on that part as I am tasked to evaluate exactly that.
Following would be my draft. I currently see it as quite 100% sure to be closed, making the answer still missing in my opinion.
Debian Linux on a small embedded computer connected to the internet via GSM Modem.
To debug, monitor, maintain and update the device it is connected via VPN to a server.
The device is currently able to act as a router for our other devices (via wifi or ethernet).
We now want to extend that router functionality to implement an open Wifi AP instead of the current closed one.
I need to figure out if there is a way to reasonable secure the Wifi AP itself to prevent malicous user from accessing anything on the Wifi AP itself, especially our VPN connection.
For now I am thinking of at least limiting access via iptables, blocking every access to the VPN IPs, basically limiting the wifi clients to access anything else, but I was unable to find additional security steps I should take.
What other steps would one have to take?
Am I totally wrong in thinking that the primary question I linked already tries to ask this but the answers focus on something at least partially else? How would I otherwise further educate myself, seeing that it seems quite hard (at least for me) to find information about this topic?