DD-WRT v24-sp2 (03/16/12) vpnkong
I had been running an older version, I believe it was a MEGA build (DD-WRT "Mega" BETA svn 14826 (2010-07-18) for WNR3500L), but decided based on other changes in my network - why not go the whole hog.
Unfortunately there were a couple of issues:
- I couldn't use my previous settings, since the port forwarding rules were not impoted correctly.
- Filter WAN NAT Redirection seems to be broken and required a workaround
iptables -t nat -A POSTROUTING -j MASQUERADE
This worked around the Filter WAN NAT Redirection problem (it doesn't appear that I can disable it)
Point 2 specifically prevented me reaching internal services that had port forwarding associated with them.