In the hope that I can save others the bit of frustration I recently went through, I wanted to describe a bug in the DD-WRT firmware shipped on Buffalo's "AirStation HighPower N450 Giga" (model WZR-HP-G450H). DD-WRT has already fixed the problem, and I found a workaround to help others who run into the same problem.
You can't set the VPN netmask when setting up a "Router (TUN)" VPN. No matter what you enter, it always comes back with "0.0.0.0"
This was fixed in changeset 20392. But Buffalo ships revision 20025 on their "AirStation HighPower N450 Giga".
Set Server mode to "Bridge (TAP)" and set the netmask, and save the settings. This will set the VPN netmask value. Then set Server mode to "Router (TUN)" and apply settings. The netmask value set in bridge mode is retained for the router mode.