I put a 2nd router behind my regular router and switch the gateway, on devices I want to use the VPN, to this 2nd router.
Benefits:
1. allow devices to use non-vpn friendly sites
2. Keeps everyone on the same subnet so the VPN is not in the way for local file transfers.
3. main router not overburdened by VPN software
Tomato allows selective routing, both by destination and by device, so that's helpful. Your setup definitely avoids some of the overhead mine has. But, really, I'd just like the little ARM processor in my R7000 to be able to keep up so I can saturate my link. I'm not familiar with ARM's ISA all that much, but it seems an AES-NI equivalent would be really nice to have.
