Connect Tomato router over WiFi to public VPN WiFi and keep local WiFi & LAN behind NAT?

Question

I want to use my Tomato based router as a WiFi gateway to the outside world, but also use the internal WLAN SSID.

The reason is that I have a couple of devices that I do not want to connect to the outside WiFi world directly: I want to have them behind NAT.

I know I could do this with an extra access point on the LAN0..LAN3 ports or a WiFi CLIENT device that connects to the WAN port, but I don't want to add extra hardware.

What steps should I take to make this kind of setup:

+----------------------------------------+
| WiFi access provider                   |  (for instance FON)
+----X-----------------------------------+
     ^
     |  SSID X (remote WiFi network)
     v
   Wireless Interface eth1
+----X-----------------------------------+
| Tomato 1.28 based router               X WAN port (not connected)
| Asus RT-N66U                           X LAN0 port br0 (not connected)
|                                        X LAN1 port br0 (not connected)
|                                        X LAN2 port br0 (not connected)
|   NAT                                  X LAN3 port br0 (not connected)
+----X-----------------------------------+
   Wireless Interface eth2
     ^
     |  SSID Y (local WiFi network)
     v
+----X-----------------------------------+
| Devices not having LAN connection      |
+----------------------------------------+