Setting up a dedicated VPN VLAN

@trendy : I add via $route_vpn_gateway in route-up.sh file.

But I have always a problem with running the command -route-up in System Logs: WARNING: Failed running command (--route-up): external program exited with error status: 255

I don't understand why ...

I convert the file route-up.sh to an executable file :

chmod +x /etc/openvpn/route-up.sh

My Ovpn file is :

client
dev tun3

proto udp
remote xxxxxxxxxx.protonvpn.com 80

resolv-retry infinite
nobind
cipher AES-256-CBC
auth SHA512
comp-lzo no
verb 3

tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun

reneg-sec 0

remote-cert-tls server
auth-user-pass '/etc/openvpn/ProtonVPN.auth'

script-security 2
route-noexec
route-up '/etc/openvpn/route-up.sh'

fast-io


<ca>
-----BEGIN CERTIFICATE-----
xxxxx
-----END CERTIFICATE-----
</ca>

key-direction 1
<tls-auth>
# 2048 bit OpenVPN static key
-----BEGIN OpenVPN Static key V1-----
xxxxx
-----END OpenVPN Static key V1-----
</tls-auth>

And in system logs, I have :

daemon.notice openvpn(VPN)[2378]: OpenVPN 2.4.7 mipsel-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
daemon.notice openvpn(VPN)[2378]: library versions: OpenSSL 1.1.1g  21 Apr 2020, LZO 2.10
daemon.warn openvpn(VPN)[2378]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
daemon.notice openvpn(VPN)[2378]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
daemon.notice openvpn(VPN)[2378]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
daemon.notice openvpn(VPN)[2378]: TCP/UDP: Preserving recently used remote address: [AF_INET]103.125.234.202:80
daemon.notice openvpn(VPN)[2378]: Socket Buffers: R=[163840->163840] S=[163840->163840]
daemon.notice openvpn(VPN)[2378]: UDP link local: (not bound)
daemon.notice openvpn(VPN)[2378]: UDP link remote: [AF_INET]103.125.234.202:80
daemon.notice openvpn(VPN)[2378]: TLS: Initial packet from [AF_INET]103.125.234.202:80, sid=45d8dffe 5fd15c9b
daemon.warn openvpn(VPN)[2378]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
daemon.notice openvpn(VPN)[2378]: VERIFY OK: depth=2, C=CH, O=ProtonVPN AG, CN=ProtonVPN Root CA
daemon.notice openvpn(VPN)[2378]: VERIFY OK: depth=1, C=CH, O=ProtonVPN AG, CN=ProtonVPN Intermediate CA 1
daemon.notice openvpn(VPN)[2378]: VERIFY KU OK
daemon.notice openvpn(VPN)[2378]: Validating certificate extended key usage
daemon.notice openvpn(VPN)[2378]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
daemon.notice openvpn(VPN)[2378]: VERIFY EKU OK
daemon.notice openvpn(VPN)[2378]: VERIFY OK: depth=0, CN=jp-105.protonvpn.com
daemon.notice openvpn(VPN)[2378]: Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
daemon.notice openvpn(VPN)[2378]: [jp-105.protonvpn.com] Peer Connection Initiated with [AF_INET]103.125.234.202:80
daemon.notice openvpn(VPN)[2378]: SENT CONTROL [jp-105.protonvpn.com]: 'PUSH_REQUEST' (status=1)
daemon.notice openvpn(VPN)[2378]: SENT CONTROL [jp-105.protonvpn.com]: 'PUSH_REQUEST' (status=1)
daemon.notice openvpn(VPN)[2378]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.8.8.1,sndbuf 524288,rcvbuf 524288,explicit-exit-notify,comp-lzo no,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.8.0.28 255.255.255.0,peer-id 31,cipher AES-256-GCM'
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: timers and/or timeouts modified
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: explicit notify parm(s) modified
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: compression parms modified
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
daemon.notice openvpn(VPN)[2378]: Socket Buffers: R=[163840->327680] S=[163840->327680]
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: --ifconfig/up options modified
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: route options modified
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: route-related options modified
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: peer-id set
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: adjusting link_mtu to 1657
daemon.notice openvpn(VPN)[2378]: OPTIONS IMPORT: data channel crypto options modified
daemon.notice openvpn(VPN)[2378]: Data Channel: using negotiated cipher 'AES-256-GCM'
daemon.notice openvpn(VPN)[2378]: Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
daemon.notice openvpn(VPN)[2378]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
daemon.notice openvpn(VPN)[2378]: TUN/TAP device tun3 opened
daemon.notice openvpn(VPN)[2378]: TUN/TAP TX queue length set to 100
daemon.notice openvpn(VPN)[2378]: /sbin/ifconfig tun3 10.8.0.28 netmask 255.255.255.0 mtu 1500 broadcast 10.8.0.255
daemon.notice netifd: Interface 'tun3' is enabled
daemon.notice netifd: Network device 'tun3' link is up
daemon.notice netifd: Interface 'tun3' has link connectivity
daemon.notice netifd: Interface 'tun3' is setting up now
daemon.notice netifd: Interface 'tun3' is now up
user.notice firewall: Reloading firewall due to ifup of tun3 (tun3)
daemon.warn odhcpd[1131]: A default route is present but there is no public prefix on lan thus we don't announce a default route!
daemon.warn openvpn(VPN)[2378]: WARNING: Failed running command (--route-up): external program exited with error status: 255
daemon.notice openvpn(VPN)[2378]: Initialization Sequence Completed

What I do wrong ?
Thank you in advance.