I set it up to use certificates, and it comes bundled with scripts to easily create and manage certificates from the CLI. You can install OpenVPN on Windows or any Unix including Mac. OpenVPN has the advantage of being very secure and running over a single UDP port, so it is easy to route, unlike IPSec. If the client doesn't want to buy anything, and your current router doesn't support VPN endpoints, your only option that I would take is to set up OpenVPN on one of the computers in the network, and port forward to it. You can install OpenVPN or any other VPN that a Linux box supports. This router has a gigabit switch, 802.11n wireless and there is heaps of space for OpenWRT. I have been using TP Link WR1043ND as a router with a ADSL2 modem on the WAN port. If the client is adamant that they do not want a firewall, they might be more receptive to a new router. pfSense has support for OpenVPN, IPSec and PPTP (Which I really don't use)

I used to roll my own Linux distribution designed for firewalling that fitted onto a CF disk, but I have abandoned that in favour of pfSense as my development time was limited. I really like pfSense as it is quite powerful and has a web interface that gives some value to the clients. My preferred situation is to comission a firewall using a disused computer with two network interfaces. You don't open anything to the internet on a windows machine if you don't want the windows machine to be compromised. This environment was not by design, but rather what a client has evolved and then asking me to come in behind to 'open up files to the internet'. I have done this in a pure Windows environment with a low buck router.

Tp link openvpn mac client