as i can see, 
i can use Managed switched cabable of filtering MAC like cisco,
i can use VPN , dialup at eatch client, server at m0n0wall
i can cure and secure Clients to prevent such attacks 
and to find bad clients and ripoff thier Ethernet Cables.
 
i realy can play with software, hardware will be much for me.
now a little question popup 
if i use VPN can i still have users passwing through captive portal after logging on the vpn ?
id if so,, do i need a 3rd interface on my m0n0wall?
 
best regards.