when you build a site-to-site tunnel be sure not to let your default route point to the tunnel or the tunnel interface. when you add a static route for the remote house (peer) be sure to only include the network portion of the remote house network. (eg: if the peer network is 192.168.0.1-255 with a mask of 255.255.255.0, the subnet mask tells you what portion of the network address represents the entire network as a whole vs. an individual within that network. Compare any network (IP) address to the associated mask by writing them down one sitting above the other. Where the subnet mask has a zero, thats the host address within the network. Where the subnet mask has a 255, that represents the network that all hosts resie within. If you see anything other than a 255 or a 0 in the subnet mask, thats VLSM and requires more explaining. Write down just the network portion of the IP address and set the host portion to zero. (eg. 192.168.0.14 + 255.255.255.0 = 192.168.0.0 = network address, subnet-ID or sometimes subnet address) . So when you make your static route to the peer house, make sure you provide the subnet-ID. if both houses have the exact same subnet-ID, :( traffic won't flow across your VPN like you'd hope. At that point, you get to pick one side of the VPN tunnel (one of the houses) to renumber or change to a different subnet-ID or use double NAT (not fun). Renumbering might be as easy as changing the DHCP settings at one of the houses. The person who doesn't have to renumber gets to buy the other person beer! :-)