I’m having trouble connecting to my mailserver when I connect to my home via my OpenVPN server on my Openwrt router. When I disconnect the vpn server everything works well. Is this a firewall issue in my openwrt router?
My OpenVPN server is allowed access to wan, like my lan on the router’s firewall
(Mailserver is on a synology nas)
I would guess that the issue is that the mail server on the synology is rejecting connections made from a non-local subnet (from its perspective). That is to say that the OpenVPN subnet is (necessarily) different than the subnet that contains your NAS, and the mail server is probably setup to reject those connections for security. This is generally a good thing, but you should check the configuration on the NAS to see if you have the option to add additional subnets to the allow policy (or specify that it should accept from any/all subnets, although this could be a potential security/spam risk).
Your OpenVPN interface or device should be added to the LAN zone in the firewall config to make sure you have LAN access.
To check if your mail server rejects non local access as described by @psherman you can as a test enable Masquerading on the LAN zone, if you can then access your mail server it is the mail serve rejecting non local access and you should tweak the mailservers firewall to allow the OpenVPN's subnet, then disable masquerading on the LAN zone again
When I enable Masquerading on the LAN zone, the problem remains. Also when I disable the firewall on the NAS.
I’ll still have to check the mailserver options.
The mailclient complains about the openwrt certificate. (Not trusted) can that be the problem?
What certificate is in question? A mail client shouldn't ever see the router's certificate since it's connecting through the OpenWrt system, but not to OpenWrt. A web browser opening OpenWrt's LuCI web interface may complain about the certificate (since it is self signed), but that shouldn't impact mail.
Can you show us what is happening?
I made some screenshots, from my phone,
I get a posix 61 error on the mailclient, and I just noticed that the certificate error is from the calender.
The funny things is, that I get the certificate error from the router, but it tells me that it cannot verify the identity from my nas.
So something is misconfigured but I can’t understand what it is
Sorry for the screenshots in Dutch. I’ll test some settings when I’m home. (In Türkiye right now)
What protocol do you expect?
Mail should bei SMTP for sending, either on port 25 unencrypted or 587 or 465 encrypted, IMAP for reading and managing inboxes on port 143 unencrypted or 993 encrypted or POP3 for fetching on port 110 unencrypted or 995 encrypted.
When you get a self-signed certificate for your OpenWRT router, this could mean it’s HTTPS, potentially because you’re using some kind of Microsoft OWA (or whatever the protocol is called that MS uses as its outlook-protocol that is not IMAP), either because that’s what you’re actually using or because some of your firewall rules redirect traff that is intended for a server in your local network to be treated and routed as incoming traffic to your router.
I guess we need a diagram of your network as you think it is set up alongside of your routing configuration to check if is acutally the way you think it is.
In addition to a topology diagram, let’s see your complete config.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
I’ll let you’ll know when l’m home. It’s a pain in the … via a mobile phone.to ssh 
ubus call system board
root@Router:~# ubus call system board
{
"kernel": "6.12.74",
"hostname": "Router",
"system": "ARMv8 Processor rev 3",
"model": "Raspberry Pi 4 Model B Rev 1.2",
"board_name": "raspberrypi,4-model-b",
"rootfs_type": "ext4",
"release": {
"distribution": "OpenWrt",
"version": "25.12.2",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r32802-f505120278",
"target": "bcm27xx/bcm2711",
"description": "OpenWrt 25.12.2 r32802-f505120278",
"builddate": "1774469393"
}
}
root@Router:~#
cat /etc/config/network
root@Router:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdad:b459:8594::/48'
option packet_steering '1'
option dhcp_default_duid '0004d1c01a395ec44db18acbaadd9025aafc'
config interface 'lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option device 'br-lan'
option ip6assign '64'
config interface 'wan'
option proto 'dhcp'
option device 'eth0.10'
option metric '10'
option peerdns '0'
list dns '9.9.9.9'
list dns '149.112.112.112'
config interface 'wan6'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
option peerdns '0'
option device 'eth0.10'
list dns '2620:fe::fe'
list dns '2620:fe::9'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.20'
config interface 'ziggo_lan'
option proto 'static'
option device 'eth0.30'
list ipaddr '192.168.180.1/24'
option ip6assign '62'
config interface 'RECOVERY'
option proto 'static'
option device 'eth0'
option ipaddr '10.0.10.1'
option netmask '255.255.255.0'
config interface 'wg0'
option proto 'wireguard'
option private_key ‘xxxxxxxx’
list addresses '10.2.0.2/32'
config wireguard_wg0
option public_key ‘xxxxxxx’
list allowed_ips '0.0.0.0/0'
option persistent_keepalive '25'
option description 'WG'
option endpoint_host '149.102.244.107'
option endpoint_port '51820'
config device
option name 'phy0-sta0'
at /etc/config/wireless
root@Router:~# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option channel '36'
option hwmode '11a'
option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
option htmode 'VHT80'
option disabled '1'
option country 'FR'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
option macaddr '60:38:e0:c7:73:02'
config wifi-device 'radio1'
option type 'mac80211'
option channel '11'
option hwmode '11g'
option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
option htmode 'HT20'
option country 'FR'
option disabled '1'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
option macaddr '60:38:e0:c7:73:01'
option disabled '1'
config wifi-device 'radio2'
option type 'mac80211'
option channel '34'
option hwmode '11a'
option path 'platform/soc/soc:internal-regs/f10d8000.sdhci/mmc_host/mmc0/mmc0:0001/mmc0:0001:1'
option htmode 'VHT80'
option disabled '1'
config wifi-iface 'default_radio2'
option device 'radio2'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
config wifi-device 'radio3'
option type 'mac80211'
option channel '36'
option hwmode '11a'
option path 'platform/soc/fe300000.mmcnr/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
option htmode 'VHT80'
option cell_density '0'
option disabled '1'
config wifi-iface 'default_radio3'
option device 'radio3'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
option disabled '1'
cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
list server '9.9.9.9'
list server '149.112.112.112'
option dnssec '1'
option doh_backup_noresolv '-1'
option noresolv '1'
option sequential_ip '1'
list addnmount '/var/run/pbr.dnsmasq'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option dns_service '0'
option force '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
option start '100'
option limit '150'
option leasetime '12h'
config odhcpd 'odhcpd'
option leasefile '/tmp/odhcpd.leases'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piodir '/tmp/odhcpd-piodir'
option hostsdir '/tmp/hosts'
config host
option name 'raspberrypi'
option ip '192.168.1.172'
option mac 'B8:27:EB:F6:F4:DC'
config host
option name 'HarmonyHub'
option ip '192.168.1.236'
option mac '00:04:20:F6:00:68'
config dhcp 'ziggo_lan'
option interface 'ziggo_lan'
option start '100'
option limit '150'
option leasetime '12h'
option ra 'server'
option dhcpv6 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option force '1'
list dns '2001:b88:1202::10'
list dns '2001:b88:1002::10'
list dns '2001:730:3e42:1000::53'
list dhcp_option '6,84.116.46.23,84.116.46.22'
list dhcp_option '6,84.116.46.20,84.116.46.21'
config domain
option ip '192.168.1.30'
option name 'nas.lan'
config domain
option ip '192.168.1.1'
option name 'router.lan'
config host
option name 'LibreELEC'
option ip '192.168.1.217'
option mac 'DC:A6:32:9E:B7:80'
config host
option ip '192.168.1.189'
option mac '5C:C3:36:56:76:62'
option name 'Camera-gang'
option dns '1'
config host
option ip '192.168.1.183'
option mac '5C:C3:36:4D:5E:71'
option name 'Camera-garage'
option dns '1'
config host
option ip '192.168.1.152'
option mac '5C:C3:36:56:28:84'
option name 'Camera-woonkamer'
option dns '1'
config host
option ip '192.168.1.191'
option mac 'EC:71:DB:68:10:46'
option name 'Camera-achtertuin'
option dns '1'
config host
option ip '192.168.1.111'
option mac 'EC:71:DB:C9:A9:A1'
option name 'Camera-voortuin'
option dns '1'
config host
option ip '192.168.1.126'
option mac 'EC:71:DB:C7:AC:59'
option name 'Camera-voortuin-garage'
option dns '1'
config host
option name 'VirtualDSM'
option ip '192.168.1.154'
list mac '02:11:32:25:A4:9C'
config host
option name 'deurbel'
option ip '192.168.1.120'
list mac '4c:6b:b8:9e:be:35'
root@Router:~#
cat /etc/config/firewall
root@Router:~# cat /etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone 'lan'
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list device 'tun+'
list network 'lan'
list network 'RECOVERY'
config zone
option name 'Ziggo'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'ziggo_lan'
config zone 'wan'
option name 'wan'
option output 'ACCEPT'
option forward 'REJECT'
option input 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option dest '*'
option src '*'
option target 'REJECT'
option name 'Block google DNS'
option proto 'all'
list dest_ip '8.8.8.8'
list dest_ip '8.8.4.4'
list dest_ip '2001:4860:4860::8888'
list dest_ip '2001:4860:4860::8844'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled '0'
config include
option path '/etc/firewall.user'
config redirect
option target 'DNAT'
option name 'http'
option src 'wan'
option src_dport '80'
option dest 'lan'
option dest_port '80'
option dest_ip '192.168.1.30'
config redirect
option target 'DNAT'
option name 'NAS https'
option src 'wan'
option src_dport '443'
option dest 'lan'
option dest_port '443'
option dest_ip '192.168.1.30'
config nat
option name 'Prevents hardcoded DNS clients error'
list proto 'tcp'
list proto 'udp'
option src 'lan'
option dest_port '53'
option target 'MASQUERADE'
option enabled '0'
option dest_ip '192.168.1.30'
config redirect
option target 'DNAT'
option name 'Mailserver '
option src 'wan'
option src_dport '25'
option dest 'lan'
option dest_port '25'
option dest_ip '192.168.1.30'
config redirect
option target 'DNAT'
option name 'Mailserver'
option src 'wan'
option src_dport '465'
option dest 'lan'
option dest_port '465'
option dest_ip '192.168.1.30'
config redirect
option target 'DNAT'
option name 'Mailserver'
option src 'wan'
option src_dport '587'
option dest 'lan'
option dest_port '587'
option dest_ip '192.168.1.30'
config redirect
option target 'DNAT'
option name 'Mailserver'
option src 'wan'
option src_dport '993'
option dest 'lan'
option dest_port '993'
option dest_ip '192.168.1.30'
config forwarding
option src 'ziggo_lan'
option dest 'wan'
config rule
option name 'dhcp vlan ziggo'
option src 'ziggo_lan'
option dest_port '67-68'
option target 'ACCEPT'
list proto 'udp'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'NAS Admin port'
option src 'wan'
option src_dport '5051'
option dest_ip '192.168.1.30'
option dest_port '5051'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'Business backup'
option src 'wan'
option src_dport '5510'
option dest_ip '192.168.1.30'
option dest_port '5510'
option enabled '0'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'Replicatie server'
option src 'wan'
option src_dport '5566'
option dest_ip '192.168.1.30'
option dest_port '5566'
option enabled '0'
config zone
option name 'Wireguard'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option input 'REJECT'
list network 'wg0'
config forwarding
option src 'lan'
option dest 'Wireguard'
config rule 'ovpn'
option name 'Allow-OpenVPN'
option src 'wan'
option dest_port '1194'
option proto 'udp'
option target 'ACCEPT'
config forwarding
option src 'Ziggo'
option dest 'wan'
config include 'pbr'
option fw4_compatible '1'
option type 'script'
option path '/usr/share/pbr/firewall.include'
root@Router:~#