I have had this working in the past, but clearly there is something I've forgotten. I have a RB4011iGS configured as a router and it sits behind my ISP's router. The config is: 1. The ISP router has a forward rule to allow any inbound WAN UDP traffic to port 1194 (OpenVPN) to be forwarded to my RB40...