OpenVPN with ExpressVPN setup cannot start

vazexa · January 16, 2023, 7:49pm

Hello,

I am a novice user of Openwrt and I am trying to enable ExpressVPN on my device using the following article
https://forum.openwrt.org/t/expressvpn-in-openvpn-on-openwrt-success/97986/3

but everytime i press the START button, the VPN does not connect and I get the following error messages from the system log.

Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 1: config: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 2: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 3: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 4: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 5: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 6: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 7: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 8: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 9: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 10: list: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 11: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 12: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 13: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 14: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 15: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 16: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 17: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 18: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 19: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 20: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 21: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 22: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 23: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 24: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 25: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 26: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 27: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 28: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 29: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 30: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 31: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 32: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 33: option: not found
Mon Jan 16 21:44:38 2023 daemon.err uhttpd[2122]: /etc/init.d/openvpn: line 34: option: not found

Can someone please help me understand what i am doing wrong?

Thank you very much in advance.

psherman · January 16, 2023, 8:08pm

Let's see the contents of the files in question:

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/openvpn
cat /etc/init.d/openvpn

EDIT: I just noticed that you are running a very old version of OpenWrt (18.06) which has been EOL and unsupported for many years. Let's also see if you can use a newer version of OpenWrt... please also include the output of this:

ubus call system board

vazexa · January 16, 2023, 9:15pm

thank you very much for your fast reply. Below are the outputs from the commands:

cat /etc/config/openvpn

config openvpn 'us_newyork'
	option client '1'
	option proto 'udp'
	option dev 'tun'
	option fast_io '1'
	option persist_key '1'
	option persist_tun '1'
	option nobind '1'
	list remote ‘xxxxxxxxxx’
	option port '1195'
	option remote_random '1'
	option pull '1'
	option comp_lzo 'no'
	option tls_client '1'
	option verify_x509_name 'Server name-prefix'
	option ns_cert_type 'server'
	option route_method 'exe'
	option route_delay '2'
	option tun_mtu '1500'
	option fragment '1300'
	option mssfix '1200'
	option verb '3'
	option cipher 'AES-256-CBC'
	option keysize '256'
	option auth 'SHA512'
	option sndbuf '524288'
	option rcvbuf '524288'
	option ca '/etc/openvpn/ca2.crt'
	option cert '/etc/openvpn/client.crt'
	option key '/etc/openvpn/client.key'
	option tls_auth '/etc/openvpn/ta.key'
	option key_direction '1'
	option auth_user_pass '/etc/openvpn/user.auth'
	option enabled '1'

cat /etc/init.d/openvpn

config openvpn 'us_newyork' # Country
	option enabled '1'
	option client '1'
	option proto 'udp'
	option dev 'tun'
	option fast_io '1'
	option persist_key '1'
	option persist_tun '1'
	option nobind '1'
	list remote ‘xxxxxxxxxxxxx’
	option port '1195'
	option remote_random '1'
	option pull '1'
	option comp_lzo 'no'
	option tls_client '1'
	option verify_x509_name 'Server name-prefix'
	option ns_cert_type 'server'
	option route_method 'exe'
	option route_delay '2'
	option tun_mtu '1500'
	option fragment '1300'
	option mssfix '1200'
	option verb '3'
	option cipher 'AES-256-CBC'
	option keysize '256'
	option auth 'SHA512'
	option sndbuf '524288'
	option rcvbuf '524288'
	option ca '/etc/openvpn/ca2.crt'
	option cert '/etc/openvpn/client.crt'
	option key '/etc/openvpn/client.key'
	option tls_auth '/etc/openvpn/ta.key'
	option key_direction '1'
	option auth_user_pass '/etc/openvpn/user.auth'

ubus call system board

{
	"kernel": "4.14.131",
	"hostname": "OpenWrt",
	"system": "ARMv7 Processor rev 1 (v7l)",
	"model": "Linksys WRT3200ACM",
	"board_name": "armada-385-linksys-rango",
	"release": {
		"distribution": "OpenWrt",
		"version": "18.06.4",
		"revision": "r7808-ef686b7292",
		"target": "mvebu\/cortexa9",
		"description": "OpenWrt 18.06.4 r7808-ef686b7292"
	}
}

psherman · January 16, 2023, 9:30pm

It looks like you replaced the init file with the openvpn configuration file. This is why you are getting all those errors -- basically the init file a script that takes the config file as an input and uses that to actually start OpenVPN.

The solution here will be to remove OpenVPN and then reinstall it.

However...

Since your current OpenWrt version is so old, you should go ahead and upgrade first. You can install 21.02.5.

(note: this is still a bit behind, but 22.03 builds are broken for your device... see this thread).

The upgrade will require that you reset everything to defaults during the upgrade, so you'll be configuring from scratch. Please make a backup of your existing configuration, but only use it as a reference for reconfiguring your router after the upgrade -- do not try to restore the backup into the new version.

From there, reconfigure your basic stuff, install OpenVPN, and then add your configuration file. Don't touch the /etc/init.d/openvpn file.

vazexa · January 18, 2023, 6:58am

thank you very much for your feedback, i reinstalled it and it seems to work so now when i press start, the button changes to started but when i go to whatismyip.com in order to check my ip, my ip does not change according to the country i use the vpn.

I attach below the log

Wed Jan 18 08:51:35 2023 daemon.warn openvpn()[10784]: WARNING: --keysize is DEPRECATED and will be removed in OpenVPN 2.6
Wed Jan 18 08:51:35 2023 daemon.notice openvpn()[10784]: OpenVPN 2.4.5 arm-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Wed Jan 18 08:51:35 2023 daemon.notice openvpn()[10784]: library versions: OpenSSL 1.0.2u  20 Dec 2019, LZO 2.10
Wed Jan 18 08:51:35 2023 daemon.warn openvpn()[10784]: WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Wed Jan 18 08:51:35 2023 daemon.notice openvpn()[10784]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Jan 18 08:51:35 2023 daemon.notice openvpn()[10784]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Jan 18 08:51:35 2023 daemon.notice openvpn()[10784]: TCP/UDP: Preserving recently used remote address: [AF_INET]217.138.202.66:1195
Wed Jan 18 08:51:35 2023 daemon.notice openvpn()[10784]: Socket Buffers: R=[163840->327680] S=[163840->327680]
Wed Jan 18 08:51:35 2023 daemon.notice openvpn()[10784]: UDP link local: (not bound)
Wed Jan 18 08:51:35 2023 daemon.notice openvpn()[10784]: UDP link remote: [AF_INET]
Wed Jan 18 08:51:36 2023 daemon.notice openvpn()[10784]: TLS: Initial packet from [AF_INET]
, sid=613f274f 9cdd2ded
Wed Jan 18 08:51:36 2023 daemon.warn openvpn()[10784]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Jan 18 08:51:36 2023 daemon.notice openvpn()[10784]: VERIFY OK: depth=1, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
Wed Jan 18 08:51:36 2023 daemon.notice openvpn()[10784]: VERIFY OK: nsCertType=SERVER
Wed Jan 18 08:51:36 2023 daemon.notice openvpn()[10784]: VERIFY X509NAME OK: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-6967-0a, emailAddress=support@expressvpn.com
Wed Jan 18 08:51:36 2023 daemon.notice openvpn()[10784]: VERIFY OK: depth=0, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-6967-0a, emailAddress=support@expressvpn.com
Wed Jan 18 08:51:36 2023 daemon.notice openvpn()[10784]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Jan 18 08:51:36 2023 daemon.notice openvpn()[10784]: [Server-6967-0a] Peer Connection Initiated with [AF_INET]217.138.202.66:1195
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: SENT CONTROL [Server-6967-0a]: 'PUSH_REQUEST' (status=1)
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.166.0.1,comp-lzo no,route 10.166.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.166.0.18 10.166.0.17,peer-id 3,cipher AES-256-GCM'
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: OPTIONS IMPORT: timers and/or timeouts modified
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: OPTIONS IMPORT: compression parms modified
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: OPTIONS IMPORT: --ifconfig/up options modified
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: OPTIONS IMPORT: route options modified
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: OPTIONS IMPORT: peer-id set
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: OPTIONS IMPORT: adjusting link_mtu to 1629
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: OPTIONS IMPORT: data channel crypto options modified
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: Data Channel: using negotiated cipher 'AES-256-GCM'
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: NCP: overriding user-set keysize with default
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: TUN/TAP device tun0 opened
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: TUN/TAP TX queue length set to 100
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Jan 18 08:51:37 2023 daemon.notice openvpn()[10784]: /sbin/ifconfig tun0 10.166.0.18 pointopoint 10.166.0.17 mtu 1500
Wed Jan 18 08:51:40 2023 daemon.notice openvpn()[10784]: /sbin/route add -net netmask 255.255.255.255 gw 
Wed Jan 18 08:51:40 2023 daemon.notice openvpn()[10784]: /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 
Wed Jan 18 08:51:40 2023 daemon.notice openvpn(bulgaria)[10784]: /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.166.0.17
Wed Jan 18 08:51:40 2023 daemon.notice openvpn()[]: /sbin/route add -net 10.166.0.1 netmask 255.255.255.255 gw 10.166.0.17
Wed Jan 18 08:51:40 2023 daemon.notice openvpn()[10784]: Initialization Sequence Completed
root@OpenWrt:~#

should i change the firewall zone of my wan connection to OVPN?

psherman · January 18, 2023, 7:09am

The tunnel is up.
Let’s take a look at your config files.

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall

vazexa · January 18, 2023, 8:47pm

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix ''

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.6.1'
	option gateway '192.168.6.1'
	option delegate '0'
	option force_link '0'
	option macaddr '26:F5:A2:30:0D:39'

config interface 'wan'
	option ifname 'eth1.2'
	option proto 'dhcp'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 5t'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'
	option vid '2'

config route 'wwan_route'
	option interface 'wwan'
	option target '0.0.0.0'
	option gateway '192.168.8.1'
	option netmask '0.0.0.0'
	option metric '50'

config interface 'wwan'
	option proto 'dhcp'
	option ifname 'eth2'
	option detaultroute '0'

config interface 'OVPN'
	option proto 'none'
	option ifname 'eth0'
	option auto '1'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan'
	list device 'tun+'

config zone 'wan'
	option conntrack '1'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan6 wwan WWAN2 wan'
	list device 'tun+'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport ''
	option dest_ip ''
	option dest_port ''
	option name ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option dest_ip ''
	option name ''
	option src_dport ''
	option dest_port ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport ''
	option dest_port ''
	option name ''
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '9999'
	option dest_ip '192.168.6.1'
	option dest_port '80'
	option name 'remote access'
	option enabled '0'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '5224'
	option dest_ip ''
	option dest_port '5224'
	option name ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option dest_port ''
	option proto 'tcp'
	option name ''
	option src_dport ''
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'udp'
	option src_dport ''
	option dest_port ''
	option name ''
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'udp'
	option src_dport ''
	option dest_port ''
	option name ''
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp'
	option src_dport ''
	option dest_port ''
	option name ''
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option src_dport ''
	option dest_port ''
	option name ''
	option proto 'udp'
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp'
	option src_dport ''
	option dest_port ''
	option name 'P'
	option dest_ip ''

config include 'miniupnpd'
	option type 'script'
	option path '/usr/share/miniupnpd/firewall.include'
	option family 'any'
	option reload '1'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp'
	option src_dport '32469'
	option dest_port '32469'
	option name 'plex_32469_TCP'
	option dest_ip '192.168.6.24'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '32410-32414'
	option dest_port '32410-32414'
	option name 'plex_32410-32414_UDP'
	option dest_ip '192.168.6.24'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '81'
	option dest_ip '192.168.6.239'
	option dest_port '81'
	option name 'Ip camera'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '8000'
	option dest_ip '192.168.6.239'
	option dest_port '8000'
	option name 'ip camera 1'

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option dest_ip '192.168.6.239'
	option name 'ip camera 1'
	option src_dport '554'
	option dest_port '554'

config zone
	option name 'ovpn_fw'
	option forward 'REJECT'
	option output 'ACCEPT'
	option input 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'OVPN'

config forwarding
	option dest 'ovpn_fw'
	option src 'lan'

config rule 'ovpn'
	option name 'Allow-OpenVPN'
	option src 'wan'
	option dest_port '1194'
	option proto 'udp'
	option target 'ACCEPT'

psherman · January 18, 2023, 9:19pm

There are a bunch of issues here... we'll try to fix them, but it does appear you're still running 18.06 based on the syntax in these files. I would highly recommend that you upgrade to 21.02.

I'll do the best I can here, but the syntax has changed so it is possible I'll end up with some mistakes (because I don't remember the old syntax).

There are a bunch of lines that should be removed from your lan interface definitoin... make it look like this:

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.6.1'
	option macaddr '26:F5:A2:30:0D:39'

On your wwan_route, this should not be necessary unless you have multiple wans running... remove it (unless there is a wired wan)

also, wwan probably shouldn't be assigned to eth2... instead, it should be probably only associated with a wireless network (in sta mode)... you should also remove the defaultroute '0' declaration. (again, unless you have multiple wans...
make it look like this:

config interface 'wwan'
	option proto 'dhcp'

the OVPN interface should not be bound to eth0... it should be tun0, like this:

config interface 'OVPN'
	option proto 'none'
	option ifname 'tun0'

In the firewall, you've got the tun+ device added in several places... it hsould be removed from all the current zones and added (as a network) to a new zone...

remove tun+ here:

and remove it from here (while you're at it, remove WWAN2:

vazexa:

config zone 'wan'
	option conntrack '1'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan6 wwan WWAN2 wan'
	list device 'tun+'

I'm not sure if you redcated information here (shouldn't be necessary since this isn't actually sensitive info)... but if these are really just sitting there empty, delete them...

vazexa:

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport ''
	option dest_ip ''
	option dest_port ''
	option name ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option dest_ip ''
	option name ''
	option src_dport ''
	option dest_port ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport ''
	option dest_port ''
	option name ''
	option dest_ip ''

Although this is currently disabled, it is a very bad idea to have a remote access to the LuCI web interface (especially with an old version of OpenWrt). Your port remapping isn't going to add all that much security. I'd recommend removing it.

vazexa:

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '9999'
	option dest_ip '192.168.6.1'
	option dest_port '80'
	option name 'remote access'
	option enabled '0'

These also should be deleted if they aren't really doing anything...

vazexa:

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '5224'
	option dest_ip ''
	option dest_port '5224'
	option name ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option dest_port ''
	option proto 'tcp'
	option name ''
	option src_dport ''
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'udp'
	option src_dport ''
	option dest_port ''
	option name ''
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'udp'
	option src_dport ''
	option dest_port ''
	option name ''
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp'
	option src_dport ''
	option dest_port ''
	option name ''
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option src_dport ''
	option dest_port ''
	option name ''
	option proto 'udp'
	option dest_ip ''

config redirect
	option target 'DNAT'
	option src 'wan'
	option dest 'lan'
	option proto 'tcp'
	option src_dport ''
	option dest_port ''
	option name 'P'
	option dest_ip ''

This should be removed since you're not using an in-bound VPN connection (or are you??)

change the network from OVPN to tun0 in this section below.

Finally, you have a bunch of port forwards for things like cameras and plex and such. Those will not work properly with a VPN (to a commercial VPN provider) up and running. You'll need policy based routing to make those work. But, you should consider removing all of those and setting up an inbound (road-warrior type) VPN for access to your network resources unless they need to be generally available on the internet (to other internet users).

vazexa · January 21, 2023, 10:53am

thank you very much again for your help. I will try to fix them.

question regarding upgrading to fw21, since i cannot upload the config file, will it be very difficult to copy the settings i already have in this version?
For example i have MWAN interface with automatic connection to WWAN if WAN is offline

psherman · January 21, 2023, 4:53pm

You can create a backup of your current configuration. Many things will not be directly compatible between versions, but you can use the backup as a reference for configuring 21.02 or 22.03. With a limited set of files, it may be possible to directly move them into place or to copy/paste chunks of the files (for example, you can usually move an OpenVPN config file directly, or copy the Wireguard sections from the old network config file into the new one). Be careful, though, and pay attention to the differences in the syntax and such.

I haven't used mwan, but even if it's not 100% compatible, you should be able to use the backup files as a reference to quickly configure things.