If you don't need code generation, and can handle the learning curve of a full-bore vector editor, I recommend Inkscape. Developing skill with such a tool has other advantages, like being able to pull in images, SVG art assets, and generally doing things other than plain UML.
Other than that, I've had some good results with http://gliffy.com.
I just used http://gliffy.com. It has fancy icons for servers/firewalls, I prefer simple boxes for quick discussions.
than it would be WAN > Modem > Sophos > VLAN Switch > Unmanaged (cheap) Switch (for Endpoints)?
Thats one way to do it. I would invest in switches that support VLAN's (layer 2) for all your needs. They are marginally more expensive and give you more flexability.
Device > AP > Sophos > Freifunk Router > Sophos > Modem > VPN > Requested Target > VPN > Modem > Sophos > Freifunk Router > Sophos > AP > Device.
Device -> AP -> Freifunk Router (VPN Tunnel) -> Switch -> Sophos -> Modem -> VPN Tunnel Endpoint -> Target.
Response is the opposite. You can assume Sophos and Freifunk might add 1ms of latency. The VPN processing and connection to the VPN Tunnel Endpoint.
What are the requirements for the two switches?
Any VLAN capable switch is ok. I would suggest finding a HP switch with a real CLI to manage it. There are some recommendations in this reddit.
Your mock-up is fine. If you are interested in doing a nicer one, here are two wireframe programs you could use.
I'd make an offer, but it looks like you have plenty.