1. Router #1
-- Ethernet -> Firewall (w/wo TOR Proxy) -> Ethernet (w/dns&dhcp)
2. Router #2
-- Ethernet -> Firewall (w/wo TOR Proxy) -> WiFi (w/dns&dhcp)
3. Access Point #1
-- Ethernet -> Bridge (w/wo Wireshark) -> WiFi (wo/dns&dhcp)
4. Router #3
-- WiFi -> WiFi -> Firewall (w/wo TOR Proxy) -> Ethernet (w/dns&dhcp)
5. Router #4 (wireless hotspot)
-- WiFi -> WiFi -> Firewall (w/wo TOR Proxy) -> WiFi (w/dns&dhcp)
6. Access Point #2 (Repeater)
-- WiFi -> WiFi -> Bridge (w/wo Wireshark) -> WiFi (wo/dns&dhcp)
7. Client Bridge #1
-- WiFi -> WiFi -> Bridge (w/wo Wireshark) -> Ethernet (wo/dns&dhcp)
8. Client Bridge #2 (Wireshark Passthrough)
-- Ethernet -> Bridge (w/Wireshark) -> Ethernet (wo/dns&dhcp)
I think that I will work this up both on a Raspberry Pi and on a VM to run on my work laptop. The front connections for WiFi (#4, 5, 6, and 7) should allow for capture pages (e.g., Panera). The back connections for WiFi (#2 and 5) should allow for WPA/WPA2 and a known SSID.