Cannot connect to the Internet with OpenVPN server connected

good16

I am using an Openwrt router as an OpenVPN server. I can connect to the OpenVPN server from my Windows 7 Client.

At first, my PC is connect to the internet via Router A(192.168.88.0/24).
Then I connect my PC to the OpenVPN server via wifi of Router B(192.168.1.0/24). Another side of the router is connect to the Internet, which is a DHCP client.

Now, I want to do this (connect my PC to the Internet via Router B public IP and gateway):
my PC <-> Router B <-> Internet

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

ifconfig
br-LAN2 is the WAN (internet), while br-lan is where I use to connect to the server via wifi to configure the settings.

br-LAN2   Link encap:Ethernet  HWaddr EC:17:2F:E0:36:12
          inet addr:ABC.ABC.5.240  Bcast:ABC.ABC.5.255  Mask:255.255.255.0
          inet6 addr: fe80::ee17:2fff:fee0:3612/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4696 errors:0 dropped:24 overruns:0 frame:0
          TX packets:5429 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:561566 (548.4 KiB)  TX bytes:1999492 (1.9 MiB)

br-lan    Link encap:Ethernet  HWaddr EC:17:2F:E0:36:12
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::684f:e1ff:feae:6164/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4155 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1307 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:727613 (710.5 KiB)  TX bytes:148787 (145.2 KiB)

eth0      Link encap:Ethernet  HWaddr EC:17:2F:E0:36:12
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4188 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5920 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:585297 (571.5 KiB)  TX bytes:2038761 (1.9 MiB)
          Interrupt:4

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:372 errors:0 dropped:0 overruns:0 frame:0
          TX packets:372 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:40436 (39.4 KiB)  TX bytes:40436 (39.4 KiB)

tap0      Link encap:Ethernet  HWaddr BE:57:24:97:EE:3B
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:517 errors:0 dropped:0 overruns:0 frame:0
          TX packets:84 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:42625 (41.6 KiB)  TX bytes:5952 (5.8 KiB)

wlan0     Link encap:Ethernet  HWaddr EC:17:2F:E0:36:12
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5035 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5106 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:1087736 (1.0 MiB)  TX bytes:1157478 (1.1 MiB)

brctl show

bridge name     bridge id               STP enabled     interfaces
br-LAN2         8000.ec172fe03612       no              eth0
                                                        tap0
br-lan          8000.ec172fe03612       no              wlan0

iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            policy match dir in pol ipsec proto esp
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
syn_flood  tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN
input_rule  all  --  anywhere             anywhere
input      all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  10.8.0.0/24          anywhere
ACCEPT     all  --  192.168.2.0/24       anywhere            ctstate NEW
ACCEPT     all  --  192.168.2.0/24       anywhere            ctstate NEW
ACCEPT     all  --  anywhere             anywhere            policy match dir out pol ipsec proto esp
ACCEPT     all  --  anywhere             anywhere            policy match dir in pol ipsec proto esp
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
forwarding_rule  all  --  anywhere             anywhere
forward    all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            policy match dir out pol ipsec proto esp
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
output_rule  all  --  anywhere             anywhere
output     all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere

Chain forward (1 references)
target     prot opt source               destination
zone_lan_forward  all  --  anywhere             anywhere
zone_LAN2_forward  all  --  anywhere             anywhere

Chain forwarding_LAN2 (1 references)
target     prot opt source               destination

Chain forwarding_lan (1 references)
target     prot opt source               destination

Chain forwarding_rule (1 references)
target     prot opt source               destination

Chain forwarding_wan (1 references)
target     prot opt source               destination

Chain input (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ssh dpt:ssh
ACCEPT     udp  --  anywhere             anywhere            udp spt:ssh dpt:ssh
zone_lan   all  --  anywhere             anywhere
zone_LAN2  all  --  anywhere             anywhere

Chain input_LAN2 (1 references)
target     prot opt source               destination

Chain input_lan (1 references)
target     prot opt source               destination

Chain input_rule (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www

Chain input_wan (1 references)
target     prot opt source               destination

Chain output (1 references)
target     prot opt source               destination
zone_lan_ACCEPT  all  --  anywhere             anywhere
zone_wan_ACCEPT  all  --  anywhere             anywhere
zone_LAN2_ACCEPT  all  --  anywhere             anywhere

Chain output_rule (1 references)
target     prot opt source               destination

Chain reject (7 references)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain syn_flood (1 references)
target     prot opt source               destination
RETURN     tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50
DROP       all  --  anywhere             anywhere

Chain zone_LAN2 (1 references)
target     prot opt source               destination
input_LAN2  all  --  anywhere             anywhere
zone_LAN2_ACCEPT  all  --  anywhere             anywhere

Chain zone_LAN2_ACCEPT (3 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain zone_LAN2_DROP (0 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Chain zone_LAN2_REJECT (1 references)
target     prot opt source               destination
reject     all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere

Chain zone_LAN2_forward (1 references)
target     prot opt source               destination
zone_wan_ACCEPT  all  --  anywhere             anywhere
forwarding_LAN2  all  --  anywhere             anywhere
zone_LAN2_REJECT  all  --  anywhere             anywhere

Chain zone_lan (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:openvpn
ACCEPT     udp  --  anywhere             anywhere            udp dpt:openvpn
input_lan  all  --  anywhere             anywhere
zone_lan_ACCEPT  all  --  anywhere             anywhere

Chain zone_lan_ACCEPT (6 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain zone_lan_DROP (0 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Chain zone_lan_REJECT (1 references)
target     prot opt source               destination
reject     all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere

Chain zone_lan_forward (1 references)
target     prot opt source               destination
zone_LAN2_ACCEPT  all  --  anywhere             anywhere
zone_wan_ACCEPT  all  --  anywhere             anywhere
forwarding_lan  all  --  anywhere             anywhere
zone_lan_REJECT  all  --  anywhere             anywhere

Chain zone_wan (0 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere            udp dpt:bootpc
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
input_wan  all  --  anywhere             anywhere
zone_wan_ACCEPT  all  --  anywhere             anywhere

Chain zone_wan_ACCEPT (4 references)
target     prot opt source               destination

Chain zone_wan_DROP (0 references)
target     prot opt source               destination

Chain zone_wan_REJECT (1 references)
target     prot opt source               destination

Chain zone_wan_forward (0 references)
target     prot opt source               destination
zone_lan_ACCEPT  ah   --  anywhere             anywhere
zone_lan_ACCEPT  esp  --  anywhere             anywhere
zone_lan_ACCEPT  udp  --  anywhere             anywhere            udp spt:isakmp dpt:isakmp
zone_lan_ACCEPT  udp  --  anywhere             anywhere            udp spt:4500 dpt:4500
forwarding_wan  all  --  anywhere             anywhere
zone_wan_REJECT  all  --  anywhere             anywhere

iptabes -L -t nat

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
prerouting_rule  all  --  anywhere             anywhere
zone_lan_prerouting  all  --  anywhere             anywhere
zone_LAN2_prerouting  all  --  anywhere             anywhere

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
postrouting_rule  all  --  anywhere             anywhere
MASQUERADE  all  --  192.168.255.0/29     anywhere
MASQUERADE  all  --  10.8.0.0/24          anywhere
MASQUERADE  all  --  10.8.0.0/24          anywhere
MASQUERADE  all  --  192.168.2.0/24       anywhere
MASQUERADE  all  --  192.168.2.0/24       anywhere
zone_lan_nat  all  --  anywhere             anywhere
zone_LAN2_nat  all  --  anywhere             anywhere

Chain postrouting_rule (1 references)
target     prot opt source               destination

Chain prerouting_LAN2 (1 references)
target     prot opt source               destination

Chain prerouting_lan (1 references)
target     prot opt source               destination

Chain prerouting_rule (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www

Chain prerouting_wan (1 references)
target     prot opt source               destination

Chain zone_LAN2_nat (1 references)
target     prot opt source               destination

Chain zone_LAN2_prerouting (1 references)
target     prot opt source               destination
prerouting_LAN2  all  --  anywhere             anywhere

Chain zone_lan_nat (1 references)
target     prot opt source               destination

Chain zone_lan_prerouting (1 references)
target     prot opt source               destination
prerouting_lan  all  --  anywhere             anywhere

Chain zone_wan_nat (0 references)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain zone_wan_prerouting (0 references)
target     prot opt source               destination
prerouting_wan  all  --  anywhere             anywhere

ip route

default via ABC.ABC.5.254 dev br-LAN2  proto static
ABC.ABC.5.0/24 dev br-LAN2  proto kernel  scope link  src ABC.ABC.5.240
192.168.1.0/24 dev br-lan  proto kernel  scope link  src 192.168.1.1

server.conf

package openvpn

config openvpn openvpn
	option enabled 1

	option port 80

	option proto tcp
	option dev tap

	up "/etc/openvpn/up.sh"
	down "/etc/openvpn/down.sh"

	option ca /etc/openvpn/ca.crt
	option cert /etc/openvpn/server.crt
	option key /etc/openvpn/server.key

	option dh /etc/openvpn/dh2048.pem

	option ifconfig_pool_persist /tmp/ipp.txt

	option server_bridge "192.168.1.1 255.255.255.0 192.168.1.50 192.168.1.100"

	list push "redirect-gateway def1"

	list push "dhcp-option DNS 8.8.8.8"
	list push "dhcp-option WINS 8.8.8.8"

	option keepalive "10 120"

	option tls_auth "/etc/openvpn/ta.key 0"

	option cipher DES-EDE3-CBC

	option comp_lzo 1

	option max_clients 3

	option persist_key 1
	option persist_tun 1

	option status /tmp/openvpn-status.log

	option verb 3

client @ windows 7

client
remote 192.168.1.1 80
proto tcp
dev tap
nobind
ca ca.crt
cert client1.crt
key client1.key
comp-lzo
verb 3
keepalive 10 120
resolv-retry infinite
mute-replay-warnings
mute 20
tls-auth ta.key 1
cipher DES-EDE3-CBC

after connecting to the OpenVPN server, the route in the client shows. 192.168.88.0/24 is my router address , which I usually use it to connect to the Internet

Network Destination          Netmask         Gateway         Interface         Metric
          0.0.0.0          0.0.0.0     192.168.88.1     192.168.88.4     20
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.115     25
        127.0.0.0        255.0.0.0            On-Link         127.0.0.1    306
        127.0.0.1  255.255.255.255            On-Link         127.0.0.1    306
  127.255.255.255  255.255.255.255            On-Link         127.0.0.1    306
      192.168.1.0    255.255.255.0            On-Link     192.168.1.115    281
    192.168.1.115  255.255.255.255            On-Link     192.168.1.115    281
    192.168.1.255  255.255.255.255            On-Link     192.168.1.115    281
     192.168.88.0    255.255.255.0            On-Link      192.168.88.4    276
     192.168.88.4  255.255.255.255            On-Link      192.168.88.4    276
   192.168.88.255  255.255.255.255            On-Link      192.168.88.4    276
        224.0.0.0        240.0.0.0            On-Link         127.0.0.1    306
        224.0.0.0        240.0.0.0            On-Link      192.168.88.4    276
        224.0.0.0        240.0.0.0            On-Link     192.168.1.115    281
  255.255.255.255  255.255.255.255            On-Link         127.0.0.1    306
  255.255.255.255  255.255.255.255            On-Link      192.168.88.4    276
  255.255.255.255  255.255.255.255            On-Link     192.168.1.115    281

I have been solving it for 2 days, but in vain. Any help would be appreciated. Thanks. :mrgreen: