RT-AC87U - All systems go! Did an upgrade from 380.69_2 and everything seemed to work fine with previous configuration (custom VPN server good, port forwarding good, Manual DHCP Assignment good, all settings seemed fine and nothing bad for ~30 minutes of operation).
Decided to follow this...
http://www.snbforums.com/threads/using-rfxcom-433-usb-tranceiver-on-ac66u.22344/
looks like it's possible to get support for the z-sticks by compiling the kernel modules - though OpenHAB is asking a bit much of the lower-end openwrt routers since it uses a full JVM, you'd probably be better off...
Thanks!
The key is "OpenVPN Client" -> "Redirect Internet traffic" -> "Policy Rules"
then a From and To map will show up where I specify CIDR routing rules.
For future reference https://github.com/RMerl/asuswrt-merlin/commit/081bf5b59d01df208c11013b2998acaa0bed94ab :
OpenVPN client policy...
In the latest update we got:
"NEW: OpenVPN policy routing. You can select client IPs or destination IPs which you want to route through your VPN tunnel. You can enter a single IP (192.168.0.1) or a whole subnet in CIDR format (for example 74.125.226.112/30). You can optionally block WAN...
My understanding is that this is generated at initial setup of the device for you. It may not be using a strong RNG though, maybe it is, totally don't know, so maybe sacrifice paranoid security for convenience.