I guess I kind of knew that the wireless is on the local side of the router/switch. As an aside, the device says right on it "broadband router, with 4-port switch", so I get the feeling Linksys is trying to cover their bases. At one time, I had done enough reading to know the differences between hub, router and switch. I think I still have a rudimentary understanding. The switch would pertain to the local side, of which the wireless would be a part (a switch being more efficient in how it directs traffic than a hub would be; also allowing network cards of differing speeds). The router is what interfaces my network with the WAN or internet.

Anyway, I take it that you believe if someone is able to get past the WPA security, they will be able to break in the Windows network. I have a basic level of security in that I changed the default group name, but I'm not aware of anything else I can do beyond that.

That says my challenge is to make sure no one can break through WPA. One layer of defense is to not broadcast what my wireless access name is. That's why I turned off SSD broadcast. Another layer was to change the default name and password for the wireless device. I suppose that the proper sniffer can get past these, but now I've narrowed down the number of people capable of doing this. They have far easier  (and more interesting) targets elsewhere, so I doubt they'll spend much time trying to get into my system.

The tunneling thing interests me as well. The way I read your description is that my system would already have to be compromised in order for someone to use tunneling to get past the firewall and router. It looks like you need a helper program already installed on the computer to make that happen.

The bottom line for me is I want to set the wireless access to be as secure as possible, but still reasonably easy to connect a new laptop of my choosing to the network.