I'm currently on a project to allow mobile computers in our vehicles to access a web application. Unfortunately, most of our users are just smart enough to be dangerous...

I would like to create a large private network over a wireless (3g, 4g, whatever), but in a way that forces the users to be on that network so that I (the evil IT guy) can control what they have access to.

VPN seems like a good bet, but I want to be sure that the users are forced to only connect through it. As it stands, they're going to be using XP-based toughbooks.

What's the best way to do this?

You could use pptp or openvpn both have options to route all traffic through the VPN tunnel. I don't know about others off hand. I know there is a way, though I don't know how to do it off hand, to have openVPN create the tunnel at boot time/user login in both windows and Linux don't know if pptp has an option like that. Another way would be to lock down that computer and have them as limited user accounts then force connections from the physical NIC to only the VPN IP and make them connect to the VPN to do anything else.

Sounds good. I've gotten openvpn running on the server and a test client toughbook. Once I figure out how to force openvpn to start automatically ill post some instructions on here. Thanks for the help on that.