Using OpenVPN client to connect only some of my devices to external VPN

I'm trying to setup OpenVPN client on my router so that one of my connected devices will be automatically connected to an external VPN.

Routing traffic from a specific IP through a VPN - #33 by floatingpurr gives some clues but I'm not able to get it working.

I have a .ovpn file that I have succesfully tested with the OpenVPN client on my windows laptop.

This is what I have done on my router:
Installed:

  • openvpn-openssl
  • luci-app-openvpn
  • luci-app-pbr

My client VPN config (things marked in red changed from when tested on my laptop):

1

New interface: (I tried to add some images here but as a new forum user I'm only allowed to include one image.)
Interface name: iface_vpn_1

  • Protocol: Unmanaged
  • Device: tun1
  • Firewall zone: not sure about that one, I tried some different settings

Policy routing:

  • Name: vpn_1_policy
  • Local addresses: 192.168.1.127
  • Interface: iface_vpn_1
    (Using default for the rest.)

Problem 1: Nothing happens when I click the start button for the OpenVPN instance. (At least not indicated in the web interface.)
Then I tried with ssh and command

openvpn --config /etc/openvpn/vpn_1.ovpn

Problem 2: Then all my connected devices lost their internet connection. (Both the one that should use the VPN and the others.) Also I'm not able to access the router admin page and had to reboot the router. So it seems to me that:
2A: All devices are affected by the VPN
2B: No internet access. I tried to disable the firewall but that didn't make any difference.

So I could use some help...
It would also be nice to know how to configure without being dependent on the web interface. I know the ovpn ends up in /etc/openvpn and the interface is added to /etc/config/network. But the rest is not clear to me.

It looks like

pull-filter ignore "redirect-gateway"

doesn't work. The documentation says that it is the prefered way from version 2.4. I have 2.5.8. I tried

route-noexec

recommended for older versions and that seems to work. At least I'm able to start the client without losing contact with the router. But no traffic is routed through the firewall.
iface_vpn_1 is up and using tun1.
vpn_1_policy is marked as enabled, but there is no traffic over vpn, still going the usual way.