A recent Turris update added an OpenVPN entry to the menu.

Through it you can create a certificate authority (CA), configure a VPN, and generate certificates for clients (ideally you'd generate the keys and signing requests on the clients and have the server sign them). What's missing, though, is a setting to route all internet traffic through the tunnel — which is, at least for me, the main motivation. You can find the VPN setup guide on the Turris website. After that you just need to log in via SSH to the router and configure…

In the file /etc/config/openvpn, under the server_turris section, add the following lines:

list >push 'redirect-gateway def1'

list push 'dhcp-option DNS '

Then restart the OpenVPN service: /etc/init.d/openvpn restart. When you test it now you'll find you can connect but can't reach the internet. You need to configure the firewall (iptables)! Add the following lines to /etc/config/firewall:

config forwarding 'vpn_turris_forward_wan_out'

option src 'vpn_turris' option dest 'wan'

Then reload the firewall: /etc/init.d/firewall reload