Also, if you go the Orange Pi Zero route I strongly recommend a heatsink (all models) and I strongly recommend against the expansion board (specific to the H5 model) which adds 2 additional USB ports.
@jdjon I think your question may have been about how to route using only one Ethernet port. The answer is you need a managed switch and vlans. That's actually how lots of consumer routers work too it's just a built in switch instead of separate
USB NIC might work too, if you don't need the port(s) for WiFi. It's not like you'll be able to hit line speed of a gigabit NIC anyway with OpenVPN/Wireguard on such a setup. Of course if you already have a managed switch or another OpenWRT router in the mix a VLAN might be simpler in terms of hardware.
I own a WRT32X router with @davidc502 builds and the OpenVPN speeds are rather fast.
I use NordVPN and on good days, I get 105Mbps Download and Upload at best, if it overheats (I live in a tropical country), then maybe around 40Mbps, but your mileage may vary. 
Thanks for all the suggestions! Compared too many of those boards, my eyes hurt 
I think I might try the orange PC 2 H5. Can anyone confirm if like the zero 2 H5 the PC 2 H5 has AES support in openwrt?
It doesn't, also OpenWrt does not currenly do any kind of cpu frequency and voltage adjustments so you'll need active cooling
odroid has a new intel based device with a couple of realtek nics; bit in the hens teeth (as rare as) area right now though.
1 Like
WolfSSL library support HW acceleration on ARMv8 architecture (H5 has Cortex A53 cores) so maybe it would be possible...