This note is for a setup that allows using Linksys WRT54 router for VPNing into remote network and providing multiple PCs on your home network access to that remote network in similar fashion as they access Internet (through NAT). It is assumed that the VPN server is already available on the remote network and the “openvpn” client can be used to connect to that server. The WRT54 router is assumed to be connected to the local network  and not used for WAN/Internet access.

The standard Tomato distribution as of today does not include openvpn, so a modded version is required (download from here):
http://www.tomatomod.de/TomatoMod_1.19.1464-OnlyEssentials.7z

The script below has to be updated to include correct addresses, VPN parameters, certificates and the private key.
Then it can be put into the “Firewall” script textbox under the “Administration->Scripts” in tomato menu.

The iptables commands for DNS_ADDRESS settings are not necessary, but might be useful for making the
router mimic the remote network DNS. The local DNS then can be set up to forward DNS requests for the remote
network domain directly to the router on the local network.

insmod tun.o
cd /tmp
ln -s /usr/sbin/openvpn /tmp/vpn
./vpn --mktun --dev tap0
ifconfig tap0 up
sleep 5
iptables -t nat -A POSTROUTING -s A.B.C.D/MASK -o tap0 -j MASQUERADE
iptables -t nat -A PREROUTING -p udp -i br0 --dport 53 -j DNAT --to DNS_ADDRESS
iptables -t nat -A PREROUTING -p tcp -i br0 --dport 53 -j DNAT --to DNS_ADDRESS
echo "
================== use your config here ======================
client
dev tap0
remote VPN.SERVER.IP
resolv-retry infinite
tls-client
persist-key
persist-tun
ca ca.crt
cert cl.crt
key cl.key
ns-cert-type server
comp-lzo
verb 3
================ end use your config here =====================
" > /tmp/cl.conf
echo "
-----BEGIN CERTIFICATE-----
Cut&paste the CA or server certificate here.
-----END CERTIFICATE-----
" > /tmp/ca.crt
echo "
-----BEGIN RSA PRIVATE KEY-----
Cut&paste client private key here.
In order to decrypt it first use (for RSA):
> openssl rsa -in key.pem
-----END RSA PRIVATE KEY-----
" > /tmp/cl.key
chmod 600 /tmp/cl.key
echo "
-----BEGIN CERTIFICATE-----
Cut&paste client certificate here.
-----END CERTIFICATE-----
" > /tmp/cl.crt
./vpn --config cl.conf &