The built-in firewall in ARM600 affects the IP packets routed through an OpenVPN server because they belong to the same IP layer of the host ARM600. The Client to client setting of the OpenVPN server alters this behavior.
The default setting is that Client to client is enabled which means that the VPN tunnel is not affected by the firewall rules.
If the Client to client setting is enabled, the packets sent over that particular VPN tunnel from one client to another on the same VPN network never reach the host ARM600 network stack which is, therefore, not affected by the firewall settings by default. This simplifies the scenario that clients need to be able to connect to each other over an OpenVPN tunnel.
Note: A disabled Client to client setting does not mean that the traffic from one client to another is blocked; that traffic is just not routed directly through the VPN tunnel. If clients need to be isolated, add a firewall forwarding rule for the VPN tunnel network interface which drops that traffic.