My main issue with doing this with OpenWRT is that it is loaded with abstractions. Network, interfaces, firewall zones, bridged zones, etc. When they all work,

My main issue with doing this with OpenWRT is that it is loaded with abstractions. Network, interfaces, firewall zones, bridged zones, etc. When they all work, it's nice and almost magical. But when setting up new custom zones from scratch (like this VPN subnet/zone), I never feel quite as home as I do with the traditional Linux command-line and iptables. Basically OpenWRTs abstractions don't map cleanly to the underlying Linux-primitives I know fairly well. The impedance mismatch there is what make me consider the RPi-based solution more preferable, because I understand how and why it works.