help connecting to openvpn with stunnel

3gem

I am trying to use openvpn over stunnel on openwrt both ends. I can get the tunnel to connect, but traffic will not route over the tunnel.
Traffic does work if I bypass the stunnel option and use only openvpn. Am I missing something?

Here is the server config

persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
dev tun1
dh /etc/openvpn/dh2048.pem
ifconfig-pool-persist /tmp/openvpn_443-ipp.txt
key /etc/openvpn/server.key
log /tmp/openvpn_443.log
port 443
proto tcp
server 10.9.0.0 255.255.255.0
verb 3
push redirect-gateway def1

Server If and routes

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.9.0.0        10.9.0.2        255.255.255.0   UG    0      0        0 tun1
10.9.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun1
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0



tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.9.0.1  P-t-P:10.9.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:34 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:22394 (21.8 KiB)  TX bytes:246 (246.0 B)

client config:

client
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client.crt
dev tun
key /etc/openvpn/client.key
log /tmp/openvpn.log
tls-timeout 2
<connection>
remote 127.0.0.1 7777
proto tcp
connect-retry 10
</connection>
remote-cert-tls server
verb 7

Client route table and interface that is pushed:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.9.0.5        128.0.0.0       UG    0      0        0 tun0

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.9.0.6  P-t-P:10.9.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:22 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:10680 (10.4 KiB)

Thanks in advance.

3gem

I have a working configuration for openvpn without stunnel, but when I try to use stunnel to connect I get the following error:

WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1343 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]

Client Stunnel config:

sslVersion = all
options = NO_SSLv2
chroot = /var
setuid = nobody
setgid = nogroup
pid = /stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
options = DONT_INSERT_EMPTY_FRAGMENTS
debug = 7
output = /stunnel.log
client = yes
[openvpn]
accept =  127.0.0.1:7777
connect = 2xx.1xx.1xx.1xx:443
cert = /etc/openvpn/client.crt
key = /etc/openvpn/client.key

Openvpn client

client
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client.crt
dev tun
key /etc/openvpn/client.key
log /tmp/openvpn.log
tls-timeout 2
<connection>
remote 127.0.0.1 7777
proto tcp
connect-retry 10
</connection>
remote-cert-tls server
verb 7

Openvon Server Config

persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
dev tun1
dh /etc/openvpn/dh2048.pem
ifconfig-pool-persist /tmp/openvpn_443-ipp.txt
key /etc/openvpn/server.key
log /tmp/openvpn_443.log
port 443
proto tcp
server 10.9.0.0 255.255.255.0
verb 7
push redirect-gateway def1

I only need to uses stunnel occasionally when a firewall will disallow openvpn directly. I have tried adding mssfix max and tun-mtu, but neither fixed it.
Any help is appreciated.

3gem

Update when I remove:

push redirect-gateway def1

I can ping across the tunnel, but It does not route 0.0.0.0 across the tunnel. When I manually add the route it breaks all internet access.

Any ideas?