OpenVPN connects, but no internet connection

iamhavingtrouble · October 20, 2020, 1:47am

I am very new to this and need a lot of help as I've never read code before today and was really struggling. I did read the other posts that had similar issues as me, but I don't understand them. My goal is to have a vpn always active on this router so my brother and I can use this for online gaming.

I followed this guide:
https://support.surfshark.com/hc/en-us/articles/360010347939-How-to-set-up-a-router-with-OpenWRT.

I was able to set up OpenWrt and the openvpn on my TL Archer A7 and the internet works. But when I start the vpn it says connected, and has no internet. The A7 is connected to a gateway from like 2014 that doesn't have OpenWrt. All my devices use wifi. I know I should post some of the code here, but I'm not sure what specifically.

vgaetera · October 20, 2020, 1:51am

/etc/init.d/log restart; /etc/init.d/openvpn restart; \
sleep 10; logread -e openvpn

https://openwrt.org/docs/guide-quick-start/sshadministration

iamhavingtrouble · October 20, 2020, 2:19am

root@OpenWrt:~# /etc/init.d/log restart; /etc/init.d/openvpn restart; \sleep 10; logread -e openvpn
Tue Oct 20 07:16:56 2020 daemon.notice openvpn(vpn2)[3086]: OpenVPN 2.4.7 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Tue Oct 20 07:16:56 2020 daemon.notice openvpn(vpn2)[3086]: library versions: OpenSSL 1.1.1h  22 Sep 2020, LZO 2.10
Tue Oct 20 07:16:56 2020 daemon.warn openvpn(vpn2)[3086]: WARNING: --ping should normally be used with --ping-restart or --ping-exit
Tue Oct 20 07:16:56 2020 daemon.notice openvpn(vpn2)[3086]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Oct 20 07:16:56 2020 daemon.notice openvpn(vpn2)[3086]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Oct 20 07:16:56 2020 daemon.notice openvpn(vpn2)[3086]: TCP/UDP: Preserving recently used remote address: [AF_INET]66.115.154.135:1194
Tue Oct 20 07:16:56 2020 daemon.notice openvpn(vpn2)[3086]: Socket Buffers: R=[163840->163840] S=[163840->163840]
Tue Oct 20 07:16:56 2020 daemon.notice openvpn(vpn2)[3086]: UDP link local: (not bound)
Tue Oct 20 07:16:56 2020 daemon.notice openvpn(vpn2)[3086]: UDP link remote: [AF_INET]66.115.154.135:1194
Tue Oct 20 07:16:56 2020 daemon.notice openvpn(vpn2)[3086]: TLS: Initial packet from [AF_INET]66.115.154.135:1194, sid=bfaf2ebf 4a895558
Tue Oct 20 07:16:56 2020 daemon.warn openvpn(vpn2)[3086]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Oct 20 07:16:57 2020 daemon.notice openvpn(vpn2)[3086]: VERIFY OK: depth=1, C=VG, O=Surfshark, CN=Surfshark Intermediate CA
Tue Oct 20 07:16:57 2020 daemon.notice openvpn(vpn2)[3086]: VERIFY KU OK
Tue Oct 20 07:16:57 2020 daemon.notice openvpn(vpn2)[3086]: Validating certificate extended key usage
Tue Oct 20 07:16:57 2020 daemon.notice openvpn(vpn2)[3086]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Oct 20 07:16:57 2020 daemon.notice openvpn(vpn2)[3086]: VERIFY EKU OK
Tue Oct 20 07:16:57 2020 daemon.notice openvpn(vpn2)[3086]: VERIFY OK: depth=0, CN=us-atl-v015.prod.surfshark.com
Tue Oct 20 07:16:57 2020 daemon.warn openvpn(vpn2)[3086]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1633', remote='link-mtu 1581'
Tue Oct 20 07:16:57 2020 daemon.warn openvpn(vpn2)[3086]: WARNING: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher AES-256-GCM'
Tue Oct 20 07:16:57 2020 daemon.warn openvpn(vpn2)[3086]: WARNING: 'auth' is used inconsistently, local='auth SHA512', remote='auth [null-digest]'
Tue Oct 20 07:16:57 2020 daemon.notice openvpn(vpn2)[3086]: Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Oct 20 07:16:57 2020 daemon.notice openvpn(vpn2)[3086]: [us-atl-v015.prod.surfshark.com] Peer Connection Initiated with [AF_INET]66.115.154.135:1194
Tue Oct 20 07:16:58 2020 daemon.notice openvpn(vpn2)[3086]: SENT CONTROL [us-atl-v015.prod.surfshark.com]: 'PUSH_REQUEST' (status=1)
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: SENT CONTROL [us-atl-v015.prod.surfshark.com]: 'PUSH_REQUEST' (status=1)
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 162.252.172.57,dhcp-option DNS 149.154.159.92,redirect-gateway def1,sndbuf 524288,rcvbuf 524288,explicit-exit-notify,block-outside-dns,route-gateway 10.8.8.1,topology subnet,ping 60,ping-restart 180,ifconfig 10.8.8.9 255.255.255.0,peer-id 7,cipher AES-256-GCM'
Tue Oct 20 07:17:03 2020 daemon.err openvpn(vpn2)[3086]: Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:7: block-outside-dns (2.4.7)
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: timers and/or timeouts modified
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: explicit notify parm(s) modified
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: Socket Buffers: R=[163840->327680] S=[163840->327680]
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: --ifconfig/up options modified
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: route options modified
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: route-related options modified
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: peer-id set
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: adjusting link_mtu to 1656
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: OPTIONS IMPORT: data channel crypto options modified
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: TUN/TAP device tun0 opened
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: TUN/TAP TX queue length set to 100
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: /sbin/ifconfig tun0 10.8.8.9 netmask 255.255.255.0 mtu 1500 broadcast 10.8.8.255
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: /sbin/route add -net 66.115.154.135 netmask 255.255.255.255 gw 192.168.1.254
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.8.1
Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.8.1Tue Oct 20 07:17:03 2020 daemon.notice openvpn(vpn2)[3086]: Initialization Sequence Completed

mk24 · October 20, 2020, 2:41am

OpenVPN is running properly, so the problem is likely with the firewall or DNS.

Test DNS by pinging or traceroute to a numeric Internet site such as the well known 8.8.4.4 Google server. If this works (and traceroute shows it is going via VPN), the firewall is OK but the clients can't reach a DNS server to access sites by name.

For the firewall it is is simpler to just add the surfsharktun network (containing the tun0 interface) to the existing WAN zone. However if the VPN does not come up the LAN will be using the Internet directly. Having a separate zone prevents that -- if the VPN does not come up the LAN has no Internet.

iamhavingtrouble · October 20, 2020, 3:32am

@mk24
I tracerouted to 8.8.4.4 and it pinged 9 times and finished, but this was with the vpn not started. I started the vpn and it pinged once and it said "Destination protocol unreachable".

vgaetera · October 20, 2020, 8:36am

Perhaps you should try to reset and follow a simpler method:

If the issue persists, activate the VPN connection and post your configuration redacting the private parts:

uci show network; uci show firewall; uci show dhcp; \
head -v -n -0 /etc/firewall.* /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*; \
ip address show; ip route show table all; ip rule show; iptables-save

iamhavingtrouble · October 20, 2020, 3:43pm

@vgaetera Not sure what the private parts are, my ip? And I changed most stuff to follow the new guide, but I left the DNS as surfshark's DNS I think.

root@OpenWrt:~# uci show network; uci show firewall; uci show dhcp; \
> head -v -n -0 /etc/firewall.* /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*; \
> ip address show; ip route show table all; ip rule show; iptables-save
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd76:cc5c:9ec7::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth0.1'
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.wan=interface
network.wan.ifname='eth0.2'
network.wan.force_link='1'
network.wan.proto='dhcp'
network.wan.peerdns='0'
network.wan.dns='162.252.172.57' '149.154.159.92'
network.wan_eth0_2_dev=device
network.wan_eth0_2_dev.name='eth0.2'
network.wan_eth0_2_dev.macaddr='d8:07:b6:f8:f1:6a'
network.wan6=interface
network.wan6.ifname='eth0.2'
network.wan6.proto='dhcpv6'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='2 3 4 5 0t'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='1 0t'
firewall.@defaults[0]=defaults
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].masq='1'
firewall.@zone[0].network='lan'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].network='wan wan6'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fc00::/6'
firewall.@rule[3].dest_ip='fc00::/6'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].dest='wan'
firewall.@forwarding[0].src='lan'
dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].boguspriv='1'
dhcp.@dnsmasq[0].filterwin2k='0'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].nonegcache='0'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.@dnsmasq[0].nonwildcard='1'
dhcp.@dnsmasq[0].localservice='1'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.limit='150'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv6='server'
dhcp.lan.ra='server'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'
==> /etc/firewall.user <==
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.

==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf.auto <==
# Interface wan
nameserver 162.252.172.57
nameserver 149.154.159.92
# Interface wan6
nameserver 2600:1700:bc21:23c0::1
search attlocal.net
head: /tmp/resolv.*/*: No such file or directory
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::da07:b6ff:fef8:f169/64 scope link
       valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 2600:1700:bc21:23cf::1/64 scope global dynamic
       valid_lft 1846sec preferred_lft 1846sec
    inet6 fd76:cc5c:9ec7::1/60 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::da07:b6ff:fef8:f169/64 scope link
       valid_lft forever preferred_lft forever
7: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
8: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether d8:07:b6:f8:f1:6a brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.64/24 brd 192.168.1.255 scope global eth0.2
       valid_lft forever preferred_lft forever
    inet6 2600:1700:bc21:23c0:da07:b6ff:fef8:f16a/64 scope global dynamic
       valid_lft 3454sec preferred_lft 3454sec
    inet6 2600:1700:bc21:23c0::2c/128 scope global dynamic
       valid_lft 1846sec preferred_lft 1846sec
    inet6 fe80::da07:b6ff:fef8:f16a/64 scope link
       valid_lft forever preferred_lft forever
9: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::da07:b6ff:fef8:f169/64 scope link
       valid_lft forever preferred_lft forever
10: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether d8:07:b6:f8:f1:68 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::da07:b6ff:fef8:f168/64 scope link
       valid_lft forever preferred_lft forever
default via 192.168.1.254 dev eth0.2  src 192.168.1.64
192.168.1.0/24 dev br-lan scope link  src 192.168.1.1
192.168.1.0/24 dev eth0.2 scope link  src 192.168.1.64
broadcast 127.0.0.0 dev lo table local scope link  src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
broadcast 192.168.1.0 dev br-lan table local scope link  src 192.168.1.1
broadcast 192.168.1.0 dev eth0.2 table local scope link  src 192.168.1.64
local 192.168.1.1 dev br-lan table local scope host  src 192.168.1.1
local 192.168.1.64 dev eth0.2 table local scope host  src 192.168.1.64
broadcast 192.168.1.255 dev br-lan table local scope link  src 192.168.1.1
broadcast 192.168.1.255 dev eth0.2 table local scope link  src 192.168.1.64
default from 2600:1700:bc21:23c0::2c via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 512
default from 2600:1700:bc21:23c0::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 512
default from 2600:1700:bc21:23cf::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 512
2600:1700:bc21:23c0::/60 from 2600:1700:bc21:23c0::2c via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 384
2600:1700:bc21:23c0::/60 from 2600:1700:bc21:23c0::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 384
2600:1700:bc21:23c0::/60 from 2600:1700:bc21:23cf::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 384
2600:1700:bc21:23c0::/64 dev eth0.2  metric 256
2600:1700:bc21:23cf::/64 dev br-lan  metric 1024
unreachable 2600:1700:bc21:23cf::/64 dev lo  metric 2147483647  error -148
fd76:cc5c:9ec7::/64 dev br-lan  metric 1024
unreachable fd76:cc5c:9ec7::/48 dev lo  metric 2147483647  error -148
fe80::/64 dev eth0  metric 256
fe80::/64 dev eth0.2  metric 256
fe80::/64 dev br-lan  metric 256
fe80::/64 dev wlan0  metric 256
fe80::/64 dev wlan1  metric 256
local ::1 dev lo table local  metric 0
anycast 2600:1700:bc21:23c0:: dev eth0.2 table local  metric 0
local 2600:1700:bc21:23c0::2c dev eth0.2 table local  metric 0
local 2600:1700:bc21:23c0:da07:b6ff:fef8:f16a dev eth0.2 table local  metric 0
anycast 2600:1700:bc21:23cf:: dev br-lan table local  metric 0
local 2600:1700:bc21:23cf::1 dev br-lan table local  metric 0
anycast fd76:cc5c:9ec7:: dev br-lan table local  metric 0
local fd76:cc5c:9ec7::1 dev br-lan table local  metric 0
anycast fe80:: dev eth0 table local  metric 0
anycast fe80:: dev eth0.2 table local  metric 0
anycast fe80:: dev br-lan table local  metric 0
anycast fe80:: dev wlan0 table local  metric 0
anycast fe80:: dev wlan1 table local  metric 0
local fe80::da07:b6ff:fef8:f168 dev wlan0 table local  metric 0
local fe80::da07:b6ff:fef8:f169 dev eth0 table local  metric 0
local fe80::da07:b6ff:fef8:f169 dev br-lan table local  metric 0
local fe80::da07:b6ff:fef8:f169 dev wlan1 table local  metric 0
local fe80::da07:b6ff:fef8:f16a dev eth0.2 table local  metric 0
ff00::/8 dev eth0 table local  metric 256
ff00::/8 dev br-lan table local  metric 256
ff00::/8 dev eth0.2 table local  metric 256
ff00::/8 dev wlan0 table local  metric 256
ff00::/8 dev wlan1 table local  metric 256
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
# Generated by iptables-save v1.8.3 on Tue Oct 20 20:33:48 2020
*nat
:PREROUTING ACCEPT [2568:293904]
:INPUT ACCEPT [49:2955]
:OUTPUT ACCEPT [61:4482]
:POSTROUTING ACCEPT [33:2348]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpnfirewall_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpnfirewall_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth0.2 -m comment --comment "!fw3" -j zone_wan_prerouting
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth0.2 -m comment --comment "!fw3" -j zone_wan_postrouting
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Tue Oct 20 20:33:48 2020
# Generated by iptables-save v1.8.3 on Tue Oct 20 20:33:48 2020
*mangle
:PREROUTING ACCEPT [5774:1042102]
:INPUT ACCEPT [1185:158662]
:FORWARD ACCEPT [4420:858835]
:OUTPUT ACCEPT [2068:590601]
:POSTROUTING ACCEPT [5222:1327129]
-A FORWARD -o eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Tue Oct 20 20:33:48 2020
# Generated by iptables-save v1.8.3 on Tue Oct 20 20:33:48 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [22:1544]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpnfirewall_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpnfirewall_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpnfirewall_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpnfirewall_forward - [0:0]
:zone_vpnfirewall_input - [0:0]
:zone_vpnfirewall_output - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0.2 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0.2 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0.2 -m comment --comment "!fw3" -j zone_wan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0.2 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth0.2 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0.2 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Oct 20 20:33:48 2020

vgaetera · October 20, 2020, 3:53pm

It looks like you have missed the step of configuring your firewall:
https://openwrt.org/docs/guide-user/services/vpn/openvpn/client#firewall

In addition, you should prevent IPv6 leak:

uci set network.lan.ip6class="local"
uci commit network
/etc/init.d/network restart

And prevent DNS leak:
https://openwrt.org/docs/guide-user/base-system/dhcp_configuration#upstream_dns_provider

iamhavingtrouble · October 20, 2020, 4:22pm

@vgaetera I did the first two things you suggested, the firewall and IPv6 leak, but I think I messed up somewhere?

root@OpenWrt:~# uci show network; uci show firewall; uci show dhcp; \
> head -v -n -0 /etc/firewall.* /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*; \
> ip address show; ip route show table all; ip rule show; iptables-save
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd76:cc5c:9ec7::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth0.1'
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.ip6class='local'
network.wan=interface
network.wan.ifname='eth0.2'
network.wan.force_link='1'
network.wan.proto='dhcp'
network.wan.peerdns='0'
network.wan.dns='162.252.172.57' '149.154.159.92'
network.wan_eth0_2_dev=device
network.wan_eth0_2_dev.name='eth0.2'
network.wan_eth0_2_dev.macaddr='d8:07:b6:f8:f1:6a'
network.wan6=interface
network.wan6.ifname='eth0.2'
network.wan6.proto='dhcpv6'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='2 3 4 5 0t'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='1 0t'
network.tun0=interface
network.tun0.ifname='tun0'
network.tun0.proto='none'
network.tun0.auto='0'
firewall.@defaults[0]=defaults
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.lan=zone
firewall.lan.name='lan'
firewall.lan.input='ACCEPT'
firewall.lan.output='ACCEPT'
firewall.lan.forward='ACCEPT'
firewall.lan.masq='1'
firewall.lan.network='lan'
firewall.wan=zone
firewall.wan.name='wan'
firewall.wan.output='ACCEPT'
firewall.wan.forward='REJECT'
firewall.wan.masq='1'
firewall.wan.mtu_fix='1'
firewall.wan.input='REJECT'
firewall.wan.network='wan wan6'
firewall.wan.device='tun+'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fc00::/6'
firewall.@rule[3].dest_ip='fc00::/6'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].dest='wan'
firewall.@forwarding[0].src='lan'
dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].boguspriv='1'
dhcp.@dnsmasq[0].filterwin2k='0'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].nonegcache='0'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.@dnsmasq[0].nonwildcard='1'
dhcp.@dnsmasq[0].localservice='1'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.limit='150'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv6='server'
dhcp.lan.ra='server'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'
==> /etc/firewall.user <==
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.

==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf.auto <==
# Interface wan
nameserver 162.252.172.57
nameserver 149.154.159.92
# Interface wan6
nameserver 2600:1700:bc21:23c0::1
search attlocal.net
head: /tmp/resolv.*/*: No such file or directory
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::da07:b6ff:fef8:f169/64 scope link
       valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fd76:cc5c:9ec7::1/60 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::da07:b6ff:fef8:f169/64 scope link
       valid_lft forever preferred_lft forever
7: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
8: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether d8:07:b6:f8:f1:6a brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.64/24 brd 192.168.1.255 scope global eth0.2
       valid_lft forever preferred_lft forever
    inet6 2600:1700:bc21:23c0:da07:b6ff:fef8:f16a/64 scope global dynamic
       valid_lft 3289sec preferred_lft 3289sec
    inet6 2600:1700:bc21:23c0::2c/128 scope global dynamic
       valid_lft 3287sec preferred_lft 3287sec
    inet6 fe80::da07:b6ff:fef8:f16a/64 scope link
       valid_lft forever preferred_lft forever
9: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::da07:b6ff:fef8:f169/64 scope link
       valid_lft forever preferred_lft forever
10: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether d8:07:b6:f8:f1:68 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::da07:b6ff:fef8:f168/64 scope link
       valid_lft forever preferred_lft forever
12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN qlen 100
    link/[65534]
    inet 10.8.8.10/24 brd 10.8.8.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::fa14:bcb4:41c7:c8b7/64 scope link
       valid_lft forever preferred_lft forever
0.0.0.0/1 via 10.8.8.1 dev tun0
default via 192.168.1.254 dev eth0.2  src 192.168.1.64
10.8.8.0/24 dev tun0 scope link  src 10.8.8.10
66.115.154.135 via 192.168.1.254 dev br-lan
128.0.0.0/1 via 10.8.8.1 dev tun0
192.168.1.0/24 dev br-lan scope link  src 192.168.1.1
192.168.1.0/24 dev eth0.2 scope link  src 192.168.1.64
broadcast 10.8.8.0 dev tun0 table local scope link  src 10.8.8.10
local 10.8.8.10 dev tun0 table local scope host  src 10.8.8.10
broadcast 10.8.8.255 dev tun0 table local scope link  src 10.8.8.10
broadcast 127.0.0.0 dev lo table local scope link  src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
broadcast 192.168.1.0 dev br-lan table local scope link  src 192.168.1.1
broadcast 192.168.1.0 dev eth0.2 table local scope link  src 192.168.1.64
local 192.168.1.1 dev br-lan table local scope host  src 192.168.1.1
local 192.168.1.64 dev eth0.2 table local scope host  src 192.168.1.64
broadcast 192.168.1.255 dev br-lan table local scope link  src 192.168.1.1
broadcast 192.168.1.255 dev eth0.2 table local scope link  src 192.168.1.64
default from 2600:1700:bc21:23c0::2c via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 512
default from 2600:1700:bc21:23c0::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 512
default from 2600:1700:bc21:23cf::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 512
2600:1700:bc21:23c0::/60 from 2600:1700:bc21:23c0::2c via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 384
2600:1700:bc21:23c0::/60 from 2600:1700:bc21:23c0::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 384
2600:1700:bc21:23c0::/60 from 2600:1700:bc21:23cf::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 384
2600:1700:bc21:23c0::/64 dev eth0.2  metric 256
unreachable 2600:1700:bc21:23cf::/64 dev lo  metric 2147483647  error -148
fd76:cc5c:9ec7::/64 dev br-lan  metric 1024
unreachable fd76:cc5c:9ec7::/48 dev lo  metric 2147483647  error -148
fe80::/64 dev eth0  metric 256
fe80::/64 dev eth0.2  metric 256
fe80::/64 dev br-lan  metric 256
fe80::/64 dev wlan0  metric 256
fe80::/64 dev wlan1  metric 256
fe80::/64 dev tun0  metric 256
local ::1 dev lo table local  metric 0
anycast 2600:1700:bc21:23c0:: dev eth0.2 table local  metric 0
local 2600:1700:bc21:23c0::2c dev eth0.2 table local  metric 0
local 2600:1700:bc21:23c0:da07:b6ff:fef8:f16a dev eth0.2 table local  metric 0
anycast fd76:cc5c:9ec7:: dev br-lan table local  metric 0
local fd76:cc5c:9ec7::1 dev br-lan table local  metric 0
anycast fe80:: dev eth0 table local  metric 0
anycast fe80:: dev eth0.2 table local  metric 0
anycast fe80:: dev br-lan table local  metric 0
anycast fe80:: dev wlan0 table local  metric 0
anycast fe80:: dev wlan1 table local  metric 0
anycast fe80:: dev tun0 table local  metric 0
local fe80::da07:b6ff:fef8:f168 dev wlan0 table local  metric 0
local fe80::da07:b6ff:fef8:f169 dev eth0 table local  metric 0
local fe80::da07:b6ff:fef8:f169 dev br-lan table local  metric 0
local fe80::da07:b6ff:fef8:f169 dev wlan1 table local  metric 0
local fe80::da07:b6ff:fef8:f16a dev eth0.2 table local  metric 0
local fe80::fa14:bcb4:41c7:c8b7 dev tun0 table local  metric 0
ff00::/8 dev eth0 table local  metric 256
ff00::/8 dev br-lan table local  metric 256
ff00::/8 dev eth0.2 table local  metric 256
ff00::/8 dev wlan0 table local  metric 256
ff00::/8 dev wlan1 table local  metric 256
ff00::/8 dev tun0 table local  metric 256
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
# Generated by iptables-save v1.8.3 on Tue Oct 20 21:19:51 2020
*nat
:PREROUTING ACCEPT [515:70420]
:INPUT ACCEPT [56:3744]
:OUTPUT ACCEPT [90:6779]
:POSTROUTING ACCEPT [9:632]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i tun+ -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i eth0.2 -m comment --comment "!fw3" -j zone_wan_prerouting
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o tun+ -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o eth0.2 -m comment --comment "!fw3" -j zone_wan_postrouting
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Tue Oct 20 21:19:51 2020
# Generated by iptables-save v1.8.3 on Tue Oct 20 21:19:51 2020
*mangle
:PREROUTING ACCEPT [2756:540427]
:INPUT ACCEPT [1471:198402]
:FORWARD ACCEPT [1006:297919]
:OUTPUT ACCEPT [1872:464741]
:POSTROUTING ACCEPT [2878:762660]
-A FORWARD -o tun+ -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i tun+ -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Tue Oct 20 21:19:51 2020
# Generated by iptables-save v1.8.3 on Tue Oct 20 21:19:51 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i tun+ -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i eth0.2 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i tun+ -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i eth0.2 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o tun+ -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o eth0.2 -m comment --comment "!fw3" -j zone_wan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o tun+ -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o tun+ -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0.2 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o tun+ -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o eth0.2 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i tun+ -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i eth0.2 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Oct 20 21:19:51 2020

vgaetera · October 20, 2020, 4:36pm

You forgot to disable peer DNS on the WAN6 interface:

uci set network.wan6.peerdns="0"
uci commit network
/etc/init.d/network restart; sleep 10; \
/etc/init.d/openvpn restart

Then reconnect your client and check if you can reach the internet.

Why did you enable masquerading in the LAN zone?

iamhavingtrouble · October 20, 2020, 4:55pm

I disabled the lan masquerading and the peer DNS. But I can not reach the internet, it did say couldn't find the dns name which I think is new.

root@OpenWrt:~# uci show network; uci show firewall; uci show dhcp; \
> head -v -n -0 /etc/firewall.* /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*; \
> ip address show; ip route show table all; ip rule show; iptables-save
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd76:cc5c:9ec7::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth0.1'
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.ip6class='local'
network.wan=interface
network.wan.ifname='eth0.2'
network.wan.force_link='1'
network.wan.proto='dhcp'
network.wan.peerdns='0'
network.wan.dns='162.252.172.57' '149.154.159.92'
network.wan_eth0_2_dev=device
network.wan_eth0_2_dev.name='eth0.2'
network.wan_eth0_2_dev.macaddr='d8:07:b6:f8:f1:6a'
network.wan6=interface
network.wan6.ifname='eth0.2'
network.wan6.proto='dhcpv6'
network.wan6.peerdns='0'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='2 3 4 5 0t'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='1 0t'
network.tun0=interface
network.tun0.ifname='tun0'
network.tun0.proto='none'
network.tun0.auto='0'
firewall.@defaults[0]=defaults
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.lan=zone
firewall.lan.name='lan'
firewall.lan.input='ACCEPT'
firewall.lan.output='ACCEPT'
firewall.lan.forward='ACCEPT'
firewall.lan.network='lan'
firewall.wan=zone
firewall.wan.name='wan'
firewall.wan.output='ACCEPT'
firewall.wan.forward='REJECT'
firewall.wan.masq='1'
firewall.wan.mtu_fix='1'
firewall.wan.input='REJECT'
firewall.wan.network='wan wan6'
firewall.wan.device='tun+'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fc00::/6'
firewall.@rule[3].dest_ip='fc00::/6'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].dest='wan'
firewall.@forwarding[0].src='lan'
dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].boguspriv='1'
dhcp.@dnsmasq[0].filterwin2k='0'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].nonegcache='0'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.@dnsmasq[0].nonwildcard='1'
dhcp.@dnsmasq[0].localservice='1'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.limit='150'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv6='server'
dhcp.lan.ra='server'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'
==> /etc/firewall.user <==
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.

==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf.auto <==
# Interface wan
nameserver 162.252.172.57
nameserver 149.154.159.92
# Interface wan6
head: /tmp/resolv.*/*: No such file or directory
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::da07:b6ff:fef8:f169/64 scope link
       valid_lft forever preferred_lft forever
19: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fd76:cc5c:9ec7::1/60 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::da07:b6ff:fef8:f169/64 scope link
       valid_lft forever preferred_lft forever
20: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
21: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether d8:07:b6:f8:f1:6a brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.64/24 brd 192.168.1.255 scope global eth0.2
       valid_lft forever preferred_lft forever
    inet6 2600:1700:bc21:23c0:da07:b6ff:fef8:f16a/64 scope global dynamic
       valid_lft 3172sec preferred_lft 3172sec
    inet6 2600:1700:bc21:23c0::2c/128 scope global dynamic
       valid_lft 3170sec preferred_lft 3170sec
    inet6 fe80::da07:b6ff:fef8:f16a/64 scope link
       valid_lft forever preferred_lft forever
22: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether d8:07:b6:f8:f1:69 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::da07:b6ff:fef8:f169/64 scope link
       valid_lft forever preferred_lft forever
23: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether d8:07:b6:f8:f1:68 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::da07:b6ff:fef8:f168/64 scope link
       valid_lft forever preferred_lft forever
25: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN qlen 100
    link/[65534]
    inet 10.8.8.7/24 brd 10.8.8.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::4960:f9af:f1f7:10bf/64 scope link
       valid_lft forever preferred_lft forever
0.0.0.0/1 via 10.8.8.1 dev tun0
default via 192.168.1.254 dev eth0.2  src 192.168.1.64
10.8.8.0/24 dev tun0 scope link  src 10.8.8.7
66.115.154.135 via 192.168.1.254 dev br-lan
128.0.0.0/1 via 10.8.8.1 dev tun0
192.168.1.0/24 dev br-lan scope link  src 192.168.1.1
192.168.1.0/24 dev eth0.2 scope link  src 192.168.1.64
broadcast 10.8.8.0 dev tun0 table local scope link  src 10.8.8.7
local 10.8.8.7 dev tun0 table local scope host  src 10.8.8.7
broadcast 10.8.8.255 dev tun0 table local scope link  src 10.8.8.7
broadcast 127.0.0.0 dev lo table local scope link  src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
broadcast 192.168.1.0 dev br-lan table local scope link  src 192.168.1.1
broadcast 192.168.1.0 dev eth0.2 table local scope link  src 192.168.1.64
local 192.168.1.1 dev br-lan table local scope host  src 192.168.1.1
local 192.168.1.64 dev eth0.2 table local scope host  src 192.168.1.64
broadcast 192.168.1.255 dev br-lan table local scope link  src 192.168.1.1
broadcast 192.168.1.255 dev eth0.2 table local scope link  src 192.168.1.64
default from 2600:1700:bc21:23c0::2c via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 512
default from 2600:1700:bc21:23c0::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 512
default from 2600:1700:bc21:23cf::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 512
2600:1700:bc21:23c0::/60 from 2600:1700:bc21:23c0::2c via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 384
2600:1700:bc21:23c0::/60 from 2600:1700:bc21:23c0::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 384
2600:1700:bc21:23c0::/60 from 2600:1700:bc21:23cf::/64 via fe80::a67a:a4ff:fe2d:f8b0 dev eth0.2  metric 384
2600:1700:bc21:23c0::/64 dev eth0.2  metric 256
unreachable 2600:1700:bc21:23cf::/64 dev lo  metric 2147483647  error -148
fd76:cc5c:9ec7::/64 dev br-lan  metric 1024
unreachable fd76:cc5c:9ec7::/48 dev lo  metric 2147483647  error -148
fe80::/64 dev eth0  metric 256
fe80::/64 dev eth0.2  metric 256
fe80::/64 dev br-lan  metric 256
fe80::/64 dev wlan0  metric 256
fe80::/64 dev wlan1  metric 256
fe80::/64 dev tun0  metric 256
local ::1 dev lo table local  metric 0
anycast 2600:1700:bc21:23c0:: dev eth0.2 table local  metric 0
local 2600:1700:bc21:23c0::2c dev eth0.2 table local  metric 0
local 2600:1700:bc21:23c0:da07:b6ff:fef8:f16a dev eth0.2 table local  metric 0
anycast fd76:cc5c:9ec7:: dev br-lan table local  metric 0
local fd76:cc5c:9ec7::1 dev br-lan table local  metric 0
anycast fe80:: dev eth0 table local  metric 0
anycast fe80:: dev eth0.2 table local  metric 0
anycast fe80:: dev br-lan table local  metric 0
anycast fe80:: dev wlan0 table local  metric 0
anycast fe80:: dev wlan1 table local  metric 0
anycast fe80:: dev tun0 table local  metric 0
local fe80::4960:f9af:f1f7:10bf dev tun0 table local  metric 0
local fe80::da07:b6ff:fef8:f168 dev wlan0 table local  metric 0
local fe80::da07:b6ff:fef8:f169 dev eth0 table local  metric 0
local fe80::da07:b6ff:fef8:f169 dev br-lan table local  metric 0
local fe80::da07:b6ff:fef8:f169 dev wlan1 table local  metric 0
local fe80::da07:b6ff:fef8:f16a dev eth0.2 table local  metric 0
ff00::/8 dev eth0 table local  metric 256
ff00::/8 dev br-lan table local  metric 256
ff00::/8 dev eth0.2 table local  metric 256
ff00::/8 dev wlan0 table local  metric 256
ff00::/8 dev wlan1 table local  metric 256
ff00::/8 dev tun0 table local  metric 256
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
# Generated by iptables-save v1.8.3 on Tue Oct 20 21:51:37 2020
*nat
:PREROUTING ACCEPT [439:54923]
:INPUT ACCEPT [72:4374]
:OUTPUT ACCEPT [111:7152]
:POSTROUTING ACCEPT [2:194]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i tun+ -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i eth0.2 -m comment --comment "!fw3" -j zone_wan_prerouting
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o tun+ -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o eth0.2 -m comment --comment "!fw3" -j zone_wan_postrouting
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Tue Oct 20 21:51:37 2020
# Generated by iptables-save v1.8.3 on Tue Oct 20 21:51:37 2020
*mangle
:PREROUTING ACCEPT [4193:929128]
:INPUT ACCEPT [2265:259740]
:FORWARD ACCEPT [1740:632482]
:OUTPUT ACCEPT [3055:485772]
:POSTROUTING ACCEPT [4643:1112174]
-A FORWARD -o tun+ -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i tun+ -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Tue Oct 20 21:51:37 2020
# Generated by iptables-save v1.8.3 on Tue Oct 20 21:51:37 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i tun+ -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i eth0.2 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i tun+ -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i eth0.2 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o tun+ -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o eth0.2 -m comment --comment "!fw3" -j zone_wan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o tun+ -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o tun+ -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0.2 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o tun+ -m comment --comment "!fw3" -j reject
-A zone_wan_dest_REJECT -o eth0.2 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i tun+ -m comment --comment "!fw3" -j reject
-A zone_wan_src_REJECT -i eth0.2 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Oct 20 21:51:37 2020

vgaetera · October 20, 2020, 5:02pm

Why your WAN and LAN interfaces are in the same subnet?

Use a different subnet:

uci set network.lan.ipaddr="192.168.2.1"
uci commit network
/etc/init.d/network restart; sleep 10; \
/etc/init.d/openvpn restart

mk24 · October 20, 2020, 5:04pm

This doesn't seem right. It should be 'tun0'. Or since you've defined a stub network named tun0 aliasing to the device tun0, you could use firewall.wan.network='wan wan6 tun0'

iamhavingtrouble · October 20, 2020, 5:13pm

It works now thank you so much. I think i've learned at least a little bit. Should I delete this post since it has private information on it or keep it and edit whatever is private?

vgaetera · October 20, 2020, 5:23pm

Great!

You didn't seem to post any private keys or passwords, so it should be fine.

Actually, both ways are correct unless you have multiple VPN interfaces and want to assign them to different zones.

system · October 30, 2020, 5:23pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.