Stephan posted a description of his configuration here: LAN - green WAN - red
and after I asked to him about config files, he posted here: LAN - green WAN - red
I didn't have time yet to investigate the "VPN for separate network/ssid" thing but it should be easy to achieve if firewall zones, forwards and routes are configured properly.
Post link to OpenWRT Forum answer, may be we can "translate" to a easier to follow instructions.