OpenWrt SNAPSHOT (r25589-f84ed09d2c) Route all traffic through OpenVPN Client not working for WiFi Clients

I am using the following version: Powered by LuCI Master (git-24.077.26240-f2a4910) / OpenWrt SNAPSHOT (r25589-f84ed09d2c) / Lua compatibility mode active

OpenWRT Router is connected to Another Router
OpenWRT Wan Port IP Address is: 192.168.31.170
Another Router IP Address is: 192.168.31.1

Assuming that OpenWRT Router is "B" Router
Assuming that the other Router is "A" Router

B <-----> A <-------> Internet ISP

Router A and Router B connected in the following way:

B (WAN Port) <-------------> (LAN Port) A (WAN Port) <-------------> ISP

SSID on B is not the Same like SSID of A

on OpenWRT I created OpenVPN Client. I see that the OpenVPN Client is function properly from the router it self.

but when WiFi Client is connected to OpenWRT router. there is not internet access. means that traffic is not routed through the OpenVPN Client.

here you can see the VPN Device

root@OpenWrt:~# ifconfig

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.10.1.18  P-t-P:10.10.1.17  Mask:255.255.255.255
          inet6 addr: fe80::ccf3:b9b:a637:10f8/64 Scope:Link
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:1028 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1142 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500
          RX bytes:125095 (122.1 KiB)  TX bytes:92808 (90.6 KiB)


here you can see traceroute from inside the OpenWRT (when I am doing SSH to manage the OpenWRT and execute traceroute inside it):

root@OpenWrt:~# traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 46 byte packets
 1  10.10.1.1 (10.10.1.1)  149.589 ms  150.022 ms  149.790 ms
 2  245.3.12.104 (245.3.12.104)  158.014 ms  245.3.12.64 (245.3.12.64)  153.160 ms  154.349 ms
 3  245.0.35.86 (245.0.35.86)  209.165 ms  245.0.35.118 (245.0.35.118)  153.512 ms  245.0.35.22 (245.0.35.22)  156.982 ms
 4  15.230.139.194 (15.230.139.194)  153.943 ms  15.230.139.130 (15.230.139.130)  157.887 ms  204.554 ms
 5  240.2.204.6 (240.2.204.6)  149.695 ms  240.2.204.7 (240.2.204.7)  150.671 ms  240.2.204.4 (240.2.204.4)  150.435 ms
 6  240.2.88.14 (240.2.88.14)  150.571 ms  240.2.88.12 (240.2.88.12)  152.003 ms  240.2.88.14 (240.2.88.14)  151.509 ms
 7  242.5.235.131 (242.5.235.131)  151.013 ms  242.5.234.131 (242.5.234.131)  150.616 ms  242.5.235.135 (242.5.235.135)  151.945 ms
 8  *  *  *
 9  99.83.89.105 (99.83.89.105)  151.059 ms  99.83.89.103 (99.83.89.103)  153.581 ms  99.83.89.105 (99.83.89.105)  151.148 ms
10  *  *  *
11  dns.google (8.8.8.8)  151.274 ms  151.628 ms  151.829 ms

as you can see above , 10.10.1.1 (10.10.1.1) , this is the IP address of the OpenVPN Server.
so as you can see when I am running traceroute within the OpenWRT , the traffic is going through the OpenVPN client. which means device tun1

but when a client is connected to WiFi , there is no internet connection.

which configuration I am missing here ?

here is the WiFI config on the OpenWRT:

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option channel 'auto'
        option band '2g'
        option htmode 'HE20'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Fiber 2.4Ghz USA'
        option encryption 'sae-mixed'
        option key 'WiFi-Password'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option channel 'auto'
        option band '5g'
        option htmode 'HE80'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Fiber 5Ghz USA'
        option encryption 'sae-mixed'
        option key 'WiFi-Password'
        option network 'lan'

The problem is almost certainly in the firewall. You need to have the tunnel (or its associated network) assigned to a firewall zone -- either wan or a new one -- with masquerading enabled, and then forwarding allowed from the lan zone

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/firewall

ubus call system board

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.1.82",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Xiaomi Mi Router AX3000T",
        "board_name": "xiaomi,mi-router-ax3000t",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r25589-f84ed09d2c",
                "target": "mediatek/filogic",
                "description": "OpenWrt SNAPSHOT r25589-f84ed09d2c"
        }
}

cat /etc/config/network

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdcb:5991:3e63::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.4.1'
        option netmask '255.255.255.0'

config device
        option name 'wan'
        option macaddr 'aa:d8:54:11:e6:19'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'


cat /etc/config/firewall

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Allow-Admin'
        option src 'wan'
        option proto 'tcp'
        option dest_port '22 80 443'
        option target 'ACCEPT'

root@OpenWrt:~#

The problem is almost certainly in the firewall. You need to have the tunnel (or its associated network) assigned to a firewall zone -- either wan or a new one -- with masquerading enabled, and then forwarding allowed from the lan zone

can you explain ?

Q1: the tun1 device is created because I made OpenVPN Client configuration. and on the OpenVPN Client config I am using:

client
dev tun1
proto udp

I never created on LUCI UI
neither interfaces and nor Devices with the name tun1

Add this to the firewall file:

config zone
        option name 'vpn'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list device 'tun+'

config forwarding
        option src 'lan'
        option dest 'vpn'

Then reboot the router and try again.

so doing what you wrote was allowing the WiFi Client to connect to the internet without going through the VPN. and this is not what I want.

so what I did it to keep the exist settings but just changing them slightly.

here the config which is working for me:

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        option masq '1'
        list device 'tun1'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Allow-Admin'
        option src 'wan'
        option proto 'tcp'
        option dest_port '22 80 443'
        option target 'ACCEPT'

root@OpenWrt:~#

Remove this -- this will prevent the lan > wan forwarding (basically the VPN kill switch)

Remove the masquerading and tun+ device from here:

And re-add what I mentioned earlier.

That will fix the issue while having the correct constructs.