I just spent a few hours getting this to work, so I thought I'd share the experience and request the developers to streamline. Background: For several months I have used OpenVPN on three Tomato routers with Toastman firmware to create a seamless and always-on site-to-site VPN. I had one router set as the server, with the other two acting as clients to it. This setup uses TLS. It works great, except the latency from client to client is of course the sum of the latencies between each client and the server. Today, I decided to directly connect the two clients using OpenVPN and a static key. I disabled the "Enable Client-Client" setting in the existing server beforehand. The Problem: APparently, when using a static key, Tomato doesn't set up all the NAT and routing stuff that it does when using TLS authentication. The UI said that I'd have to set up routing, even though the "Enable NAT on tunnel" box was checked. Unchecking the box broke things further, so I left it checked. On the new VPN tunnel, the server LAN is 192.168.2.0/24, and the client LAN is 192.168.1.0/24. In order to get it to work, I had to: On the server 1. Set the "Local/Remote endpoint addresses" to 10.10.0.1/10.10.0.2 (or another pair in a different subnet than anything else being used by client or server) 2. Under VPN- Advanced, in the Advanced box, add the line: Code: route-up "/sbin/route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.10.0.2" 3. Under Administration-Scripts-Firewall, add the following lines: Code: iptables -I FORWARD -i br0 -o tun21 -j ACCEPT iptables -I FORWARD -i tun21 -o br0 -j ACCEPT iptables -I INPUT -i tun21 -j ACCEPT ip route add 192.168.1.0/24 dev tun21 *Note that tun21 is VPN server 1, and tun22 is VPN server 2. On the client 1. On the main VPN client settings page, ensure the "Create NAT on tunnel" box is checked 2. On VPN-Advanced, enter the following line in the Advanced Settings box Code: route 192.168.2.0 255.255.255.0 3. On Administration-Scripts-Firewall, add the following: Code: iptables -I FORWARD -i br0 -o tun12 -j ACCEPT iptables -I FORWARD -i tun12 -o br0 -j ACCEPT iptables -I INPUT -i tun12 -j ACCEPT *Note that tun11 is VPN client 1, and tun12 is VPN client 2. Can we have Tomato automatically set this up when the Create NAT on Tunnel box is checked, just as it does for a TLS connection?