Lee, SmallNetBuilder has a tutorial about setting up a site-to-site vpn using OpenVPN.  It's not specific to the TurnKey/GNU appliance, but that shouldn't matter.  The tutorial is a bit dated (2008) but I'm not aware of major changes to OpenVPN that would change the procedure much.  If something doesn't work, just Google to see if there is a newer way to configure the options.  This tutorial discussed the pros and cons of bridging and routing.  I recommend routing.  If you're using Windows clients at a remote site which need to access servers at the main site across the routed network, you'll need a WINS server at the remote site.  I'd consider adding Samba on the remote vpn appliance to serve this function.

Good Luck and please post back here with your results so others can benefit.

Have a look here for the TurnKey OpenVPN site-to-site docs. I haven't used the appliance really nor followed the docs so I can't comment on how good (or not) they are, but probably worth a shot for starters (if you haven't already had a look through...)

The TurnKey OpenVPN appliance is essentially a headless Debian server with OpenVPN installed from the Debian repos; with the addition of some helper scripts. So OpenVPN community probably are the ones that would know the most about it... IIRC they have a wiki and forums...

The OpenVPN HowTo at https://openvpn.net/index.php/open-source/documentation/howto.html has sample configuration files for server (main office) and client.  I recommend you change the key length to 2048.  The default of 1024 is no longer considered to be secure.

On the server, edit /etc/openvpn/easy-rsa/vars and change the KEY_SIZE and any other key information.  Mine looks like this:

...
export CA_EXPIRE=3650
export KEY_EXPIRE=3650
export KEY_SIZE=2048
export KEY_ORG="LinuxGeeks"
export KEY_EMAIL="dude4linux@gmail.com"
export KEY_NAME="openvpn"
export KEY_OU="OpenVPN"
export KEY_COUNTRY="US"
export KEY_PROVINCE="IA"
export KEY_CITY="Cedar Rapids"
export KEY_CN="must-be-unique"

Next build a Diffie-Hellman parameters dh2048.pem.

/etc/openvpn/easy-rsa/build-dh

Edit the server.conf and replace dh1024.pem with dh2048.pem

...
ca /etc/openvpn/easy-rsa/keys/ca.crt
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
key /etc/openvpn/easy-rsa/keys/server.key
cert /etc/openvpn/easy-rsa/keys/server.crt
...

Restart openvpn and then you can generate 2048 bit keys for the clients

service openvpn restart
openvpn-addclient username user-email

These changes need to be made to the next version of the OpenVPN appliance.

I also had to make a change to the gateway configuration to get it to work while at the home network.
Add 'local' to the gateway push.

push "redirect-gateway local def1 bypass-dhcp"

EDIT:  Apparently changing the client keys is not sufficient to achieve 2048 bit operation.  I'm working out how to re-gen the server.key and which ciphers to use.  Will post more later.

PPS: I'm running OpenVPN in a virtual machine behind my firewall.  Adding the 'local' option to the push statement allowed me to test from my home network (laptop -- vpn tunnel --> server --> firewall --> internet) but it broke when I tried from a remote location.  I had hoped to find a configuration that would work for both locations without having to remember to start or stop the openvpn client.  Ubuntu's network-manager seems broken for VPN's at the moment.  I had no success getting it to work with OpenVPN.  Was forced to use 'sudo service openvpn start/stop' to control the client.

I've been using Ivan Ristić's book, Bulletproof SSL and TLS, as a reference for enhancing security, but unfortunately he does not have a chapter on OpenVPN.  I'm waiting for a reply from Ivan on the merits of increasing OpenVPN's default cipher's (BF-CBC) keysize from 128 to 256 (or higher) versus switching to AES-256-CBC.  I'm currently running the latter without a noticable performance impact (supposed to be about 20% penalty relative to BF-CBC)