Isn't it easier to set it up with wireguard? I’ve recently set up my turris running “adblock” (openwrt) natively with only wireguard open, connecting from my laptop, ipad and iPhone, which seems to me to be a far lighter and easier setup ....