I would like to do the following:

WRT54GS - - - - - - - - - - - - - - - - - - - - - - - WL500G Deluxe
LAN: 192.168.1.25                                         LAN: 192.168.1.26
WIFI: 192.168.2.25                                        WIFI: 192.168.2.26

Legend:
- - - - : is a wireless connection

When the LAN and WIFI is _not_ seperated WDS is working between the two devices. I could ping each other.
What firewall rules or routes do I have to add to get this working?

Thanks.

The /sbin/hotplug script is hardcoded to add all new wds devices to the br0 bridge. That br0 doesn't have to be the lan, nor does it have to have any interfaces other than the wds links.

This should do what you want -

lan_ifname=vlan0

wifi_ifname=br0
wifi_ifnames=eth1

And just to demonstrate flexability, this is also possible:

lan_ifname=br1
lan_ifnames="vlan0 eth1"

wifi_ifname=br0
wifi_ifnames=""

All the wds devices would share br0 while the lan and normal wifi clients would share br1

                            Clients          Clients
                          (via cable)       (via cable)
                               |                |
DSL ---- WRT54GS_1 - - - - WRT54GS_2 - - - - WRT54GS_3
                               |
                          WL500GD
                         (via cable)

WRT54GS_1: 192.168.1.254
WRT54GS_2: 192.168.1.253
WRT54GS_3: 192.168.1.252
WL500GD: 192.168.1.251

Legend:
---- wired
- - - - wireless, wds, openvpn

Between WRT54GS_{1,2,3} i would like to have them connected over wds and openvpn.

Is it better to use wl0_mode=wet for this?

yes if you don't need more AP's yes wet mode is good.

and if your have lots of clients then forget the wds and bridge and use routing, you'll get more speed

don't run openvpn on the Linksys Router, insted setup a external server, if you load more stuff on this little router things go crazy slow.

when you don't have a bridge it easier to setup iptables to block unwanted traffic.

wj