Direct from real world experience, a few points of architectural guidance.
1. Use WiFi routers for WiFi.
Avoid firewalling, NAT, authentication protocols, the strongest levels of encryption, or other packet changes/control on the WiFi Router.
Resources are always constrained. Mentioned processes consume resources and the load only appears under real world conditions that you did not anticipate or could not replicate in test.
2. Distribute (as much as possible). A little work/cost up front will save you down the line.
A lot of WiFi routers support multiple radios (IE 2 radios). That gives you three points of failure for every router - one for each radio, and one for the router. Take one dual band router down and everyone in the coverage area loses connectivity in both bands.
Separating these will provide improved redundancy, throughput, offloading, and etc.
1. Use WiFi routers for WiFi.
Avoid firewalling, NAT, authentication protocols, the strongest levels of encryption, or other packet changes/control on the WiFi Router.
Resources are always constrained. Mentioned processes consume resources and the load only appears under real world conditions that you did not anticipate or could not replicate in test.
2. Distribute (as much as possible). A little work/cost up front will save you down the line.
A lot of WiFi routers support multiple radios (IE 2 radios). That gives you three points of failure for every router - one for each radio, and one for the router. Take one dual band router down and everyone in the coverage area loses connectivity in both bands.
Separating these will provide improved redundancy, throughput, offloading, and etc.