Right now it is impossible to determine if the problem is with the OpenWrt configuration or with the vpn itself, or with some unusual interaction between the two.
There is nothing in the OpenWrt setup that would present any issues from what we can see. And all the traffic moves through both routers transparently insofar is it is encapsulated within a tunnel. As a result, I doubt that OpenWrt is responsible for the issue, but it is possible that the vpn doesn’t like something (maybe the chosen subnet or something).
It used to work perfectly earlier. I'd say the point it stopped working is when I reinstalled my os. But it shouldn't have affected the router, and at least connection from phone should have stayed the same.
Yeah... it's a bit odd. But, from the perspective of the traffic between you and the website in question, the router pretty much doesn't exist because of the VPN.
Specifically, if you do a traceroute from your computer to any site (traceroute openwrt.org for example), you will not see either of the routers in the resulting trace. Instead, your first hop will be the VPN tunnel (i.e. the first router at their endpoint).
Another thing that might help. Before factory resetting and updating openwrt, I was playing around with router level adblocking. And when I first started troubleshooting I was able to load the website after I "did something" in adblock-luci page. I dont remember what I did there and it worked only once.
Well, if you setup any adblocking/DNS blocks and are still using the router as the DNS even in the context of your VPN (unlikely but possible, depending on the VPN's configuration on your computer), that could be part of it. But that would not be a factor in a default configuration of OpenWrt... so make sure you do not have any adblocks setup.
In the meantime, from your computer, try a traceroute to a website that works (like this one) and to the website that doesn't work... share the results with us (feel free to redact the name of the website if that is something you are unwilling to share).
Interesting. While I contact vpn's support I'd like to check one last thing with openwrt router. What if openwrt's dns is overwriting vpn's one? Is there a way to check it?
This is extremely unlikely. It wouldn't be an issue of OpenWrt "overwriting" but rather your computer's operating system not using the tunnel for DNS.
In this case, the DNS server that OpenWrt is using is almost certainly the upstream router itself. And if that's the case, there would be no functional difference between using the OpenWrt router vs connecting directly to the upstream router.
If you're using a Mac or Linux system, you can easily use nslookup for this purpose to see if there is even a way that this could happen:
The first line will do DNS lookup with the server your computer is using now. It will report the server information as part of the output. The second line will tell it to do the lookup with the OpenWrt router as the DNS server.
Run this with and without the VPN enabled. It is possible that the second line will error out while the VPN is active... and if that's the case, it says that the computer cannot reach the OpenWrt router itself due to the traffic being sent through the tunnel instead.
Then run it again with and without the VPN on the site that is not working. Share the results.
nslookup OpenWrt.org
Server: 172.16.0.1
Address: 172.16.0.1#53
Non-authoritative answer:
Name: OpenWrt.org
Address: 64.226.122.113
Name: OpenWrt.org
Address: 2a03:b0c0:3:d0::1a51:c001
nslookup OpenWrt.org 192.168.2.1
;; communications error to 192.168.2.1#53: timed out
;; communications error to 192.168.2.1#53: timed out
;; communications error to 192.168.2.1#53: timed out
;; no servers could be reached
slookup redacted
Server: x.x.0.1
Address: x.x.0.1#53
Non-authoritative answer:
Name: redacted
Address: x.x.16.14
nslookup redacted 192.168.2.1
;; communications error to 192.168.2.1#53: timed out
;; communications error to 192.168.2.1#53: timed out
;; communications error to 192.168.2.1#53: timed out
;; no servers could be reached
As you can see, with the VPN enabled, you cannot use the OpenWrt router as a DNS server. The default DNS that the system uses when the VPN is enabled is from the VPN provider.
When the VPN is disabled, the default server is the OpenWrt router, and you can see it works for both calls.
What is very interesting, though, is that the site in question results in different addresses depending on if it goes through the VPN or not. I don't know if one or the other is incorrect (it is not unusual for the results to be different if your home/ISP is different than the region/country where your VPN's servers are running).
VPN on and DNS via the VPN provider:
VPN off and DNS via OpenWrt (which is also the same as the DNS of the router in front of the OpenWrt device):
For some reason, changing vpn protocol from wireguard to openvpn fixes the issue. Thank for your help everyone!
Edit: Another way is to change MTU setting in WireGuard protocol. The default (for ivpn) is 1420. Changing the number to a lower one also fixes the issue.
Edit 2: The cause of the problem was the way WireGuard handles packet sizes. Each layer adds extra header bits to each packet. My network jumps between 2 routers before jumping to the web (after which it encounters more relays that also increase size) which result in fragmentation, where a packet is split in two to make it through network hops that do not support large packets.