After a few weeks trying different router GUI settings I got this working, so wanted to share the setup here to help others.

I needed this:
- two simultaneous OpenVPN connections mapped to different static IP addresses within my home network
- using Asus RT-AC66U_B1 router with latest stable Asuswrt-Merlin build 380.68_4

My VPN service providers
- IronSocket (IS) on Client 1
- PrivateInternetAccess (PIA) on Client 2

With the settings below the VPN Status page reports both VPN clients connected.  Further I see correct destination IP/DNS addresses using www.ipleak.net to test the two different computers within my network: each reports a single public IP address and a single DNS address.

I'm sharing all these details as I got confused about NAT tunneling but find these settings seem to be working as expected.  (so far I've made two small donations to Eric for the great Merlin project )

Common settings on OpenVPN VPN settings for Client 1 and Client 2
=================================================================
Start with WAN: On
Interface type: TUN
Protocol: UDP
Firewall: Automatic
Authorization mode: TLS
Username/Password Authentication: On
Username / Password Auth. Only (Must define certificate authority): No
Create NAT on tunnel (Router must be configured manually): Yes
Log verbosity (0-11, default=3): 3
Poll Interval ( Disable : 0 ): 0
Accept DNS Configuration: Exclusive
Cipher Negotiation: Disabled
TLS Renegotiation Time (in seconds, -1 for default): -1
Connection Retry (in seconds, -1 for infinite): -1
Verify Server Certificate: No
Redirect Internet traffic: Policy Rules
Block routed clients if tunnel goes down: No

Different settings on OpenVPN VPN settings for Client 1 and Client 2
====================================================================
Content modification of Keys & Certificates
Server address and port
Username
Password
TLS control channel security (tls-auth / tls-crypt):
      IS: Outgoing Auth (1)
      PIA: Disabled
Auth digest
      IS: SHA256
      PIA: SHA1
Legacy/fallback cipher:
      IS: AES-256-CBS
      PIA: AES-128-CBS
Compression:
      IS: None
      PIA: LZO Adaptive
Rules for routing client traffic through the tunnel (Max Limit : 100)
      e.g.: on Client 1
      Source IP: 192.168.50.40
      Destination IP: 0.0.0.0
      lface: VPN
      e.g.: on Client 2
      Source IP: 192.168.50.45
      Destination IP: 0.0.0.0
      lface: VPN

========================