OpenWrt - Users cannot connect to INet / LAN devices

Mean

Hi all,

I'm using OpenWrt on my private router and installed OpenVPN several weeks ago and since that time I'm trying around to get it work. After some initial problems I can now connect to the VPN via SecurePoint SSL windows application and the OpenVPN app on my iPhone.

I can only connect to the VPN, but I'm not able to connect to the internet or to a shared drive in my LAN (of course the second thing would only be possible with my windows notebook).

I guess it depends on firewall settings, but I'm not sure if I perhaps have some other faults in my config.

My (W)LAN ip is 10.50.50.x
My VPN ip is 10.1.1.x

I suspect the /var/config/openvpn to contain the error:

config openvpn 'VPNserver'
 
        option enabled     '1'
 
    # --- Protocol ---#
        option dev         'tun0'
        option topology    'subnet'
        option proto       'udp'
        option port        '1194'
 
    #--- Routes ---#
        option server    '10.1.1.0 255.255.255.0'
        option ifconfig  '10.1.1.1 255.255.255.0'
 
    #--- Client Config ---#
        option client_config_dir '/etc/openvpn/clients/'

    #--- Pushed Routes ---#
        list push    'route 192.168.1.0 255.255.255.0'
        list push    'dhcp-option DNS 192.168.1.1'
        list push    'dhcp-option WINS 192.168.1.1'
        list push    'dhcp-option DNS 8.8.8.8'
        list push    'dhcp-option DNS 8.8.4.4'
        list push    'dhcp-option NTP 129.6.15.30'
        list push    'redirect-gateway def1' 
 
    #--- Encryption ---#
        option cipher     'AES-256-CBC'
        option dh         '/etc/openvpn/keys/dh2048.pem'
        option ca         '/etc/openvpn/keys/ca.crt'
        option cert       '/etc/openvpn/keys/my-server.crt'
        option key        '/etc/openvpn/keys/my-server.key'
 
    #--- Logging ---#
        option log           '/tmp/openvpn.log'
        option status        '/tmp/openvpn-status.log'
        option verb          '7'
 
    #--- Connection Options ---#
        option keepalive        '10 120'
        option comp_lzo         'yes'
 
    #--- Connection Reliability ---#
        option client_to_client '1'
        option persist_key      '1'
        option persist_tun      '1'
 
    #--- Connection Speed ---#    
  
    #--- Pushed Buffers ---#

    #--- Permissions ---#

The bold marked ips do not match mine, but if I adjust them to 10.50.50.0 and 10.50.50.1, they are overwritten again after router restart.

Here are my other configs as well:

/etc/config/network


config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd49:8e60:7962::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '10.50.50.1'

config interface 'wan'
	option ifname 'eth1'
	option proto 'dhcp'

config interface 'wan6'
	option ifname 'eth1'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 5'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6'

config interface 'vpn0'
	option _orig_ifname 'tun0'
	option _orig_bridge 'false'
	option ifname 'tun0'
	option proto 'none'
	option auto '1'

/etc/config/firewall

config rule
	option target 'ACCEPT'
	option proto 'tcp udp'
	option family 'ipv4'
	option src '*'
	option dest_port '1194'
	option name 'Allow Inbound VPN0'

config rule
	option target 'ACCEPT'
	option proto 'tcp udp'
	option family 'ipv4'
	option src '*'
	option src_ip '10.1.1.0/24'
	option dest_ip '192.168.1.0/26'
	option name 'Allow Inbound VPN0 Traffic to LAN'

config rule
	option target 'ACCEPT'
	option proto 'tcp udp'
	option family 'ipv4'
	option src '*'
	option src_ip '10.1.1.0/24'
	option dest '*'
	option dest_ip '192.168.1.0/26'
	option name 'Allow Forwarded VPN0 Traffic to LAN'

config rule
	option target 'ACCEPT'
	option proto 'icmp'
	option src_ip '10.1.1.0/24'
	option src '*'
	option dest 'lan'
	option name 'Allow Inbound ICMP Traffic from VPN0 to LAN'

config rule
	option target 'ACCEPT'
	option proto 'icmp'
	option src '*'
	option src_ip '10.1.1.0/24'
	option dest 'wan'
	option name 'Allow Outbound ICMP Echo Request (8) from VPN0'
	list icmp_type 'echo-request'

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'DROP'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option network 'lan'
	option forward 'ACCEPT'

config zone
	option name 'vpn'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option network 'vpn0'
	option family 'ipv4'
	option masq '1'

config zone
	option name 'wan'
	option output 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	option input 'DROP'
	option forward 'DROP'
	option network 'wan wan6 vpn0'

config include
	option path '/etc/firewall.user'

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config rule
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'vpn'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option masq '1'
	option network ' '

config forwarding
	option dest 'wan'
	option src 'lan'

config forwarding
	option dest 'lan'
	option src 'vpn'

config forwarding
	option dest 'wan'
	option src 'vpn'

config forwarding
	option dest 'vpn'
	option src 'lan'

/etc/config/openvpn.receipes
-> is this really used? I have no adjustments here, but since my certificates (seem to) work, I guess this is not used at all?!

#
# Routed point-to-point server
#
config openvpn_recipe server_tun_ptp
	option _description		"Simple server configuration for a routed point-to-point VPN"
	option _role			"server"
	option dev			"tun"
	option ifconfig			"10.0.0.1 10.0.0.2"
	option secret			"shared-secret.key"
	option keepalive		"10 60"
	option comp_lzo			"yes"
	option verb			"3"
        option mssfix			"1420"

#
# Routed point-to-point client
#
config openvpn_recipe client_tun_ptp
	option _description		"Simple client configuration for a routed point-to-point VPN"
	option _role			"client"
	option dev			"tun"
	list   remote			"vpnserver.example.org"
	option ifconfig			"10.0.0.2 10.0.0.1"
	option secret			"shared-secret.key"
	option nobind			"1"
	option comp_lzo			"yes"
	option verb			"3"

#
# Routed multi-client server
#
config openvpn_recipe server_tun
	option _description		"Server configuration for a routed multi-client VPN"
	option _role			"server"
	option dev			"tun"
	option server			"10.0.100.0 255.255.255.0"
	option ca			"ca.crt"
	option cert			"server.crt"
	option key 			"server.key"
	option dh 			"dh1024.pem"
	option keepalive		"10 60"
	option comp_lzo			"yes"
	option verb			"3"
        option mssfix			"1420"

#
# Routed client
#
config openvpn_recipe client_tun
	option _description		"Client configuration for a routed multi-client VPN"
	option _role			"client"
	option client			"1"
	option dev			"tun"
	list   remote			"vpnserver.example.org"
	option pkcs12			"my_client.p12"
	option remote_cert_tls		"server"
	option comp_lzo			"yes"
	option nobind			"1"
	option persist_key		"1"
	option persist_tun		"1"
	option verb			"3"
	option reneg_sec		"0"
	option float			"1"

#
# Multi-client ethernet bridge server
#
config openvpn_recipe server_tap_bridge
	option _description		"Server configuration for an ethernet bridge VPN"
	option _role			"server"
	option dev			"tap"
	option server_bridge		"192.168.1.1 255.255.255.0 192.168.1.128 192.168.1.254"
	option ca			"ca.crt"
	option cert			"server.crt"
	option key 			"server.key"
	option dh 			"dh1024.pem"
	option keepalive		"10 60"
	option comp_lzo			"yes"
	option verb			"3"
        option mssfix			"1420"

#
# Ethernet bridge client
#
config openvpn_recipe client_tap_bridge
	option _description		"Client configuration for an ethernet bridge VPN"
	option _role			"client"
	option client			"1"
	option dev 			"tap"
	list   remote			"vpnserver.example.org"
	option ca 			"ca.crt"
	option cert			"my_client.crt"
	option key 			"my_client.key"
	option dh 			"dh1024.pem"
	option remote_cert_tls		"server"
	option comp_lzo			"yes"
	option nobind			"1"
	option persist_key		"1"
	option verb			"3"
	option reneg_sec		"0"
	option float			"1"

Thanks and kind regards,

Dirk

TinCanTech

Users cannot connect to INet
HOWTO: Routing all client traffic (including web-traffic) through the VPN

LAN devices
HOWTO: Expanding the scope of the VPN to include additional machines

Mean wrote

    #--- Pushed Routes ---#
        list push    'route 192.168.1.0 255.255.255.0'
        list push    'dhcp-option DNS 192.168.1.1'
        list push    'dhcp-option WINS 192.168.1.1'

This is all wrong because you do not have a 192.168.1.0/24 subnet.

Mean wroteThe bold marked ips do not match mine, but if I adjust them to 10.50.50.0 and 10.50.50.1, they are overwritten again after router restart.

Please see the openwrt documentation.

Mean wrote/etc/config/openvpn.receipes
-> is this really used?

These look like examples. (They do not include the enabled=1 option)

Mean

Thanks for your fast response.

I'd like to take one step after another, so I wanted to get the internet connection for vpn connected clients work. In the first step I didn't follow your "LAN Devices" link.

TinCanTech wrote=
Mean wrote
    #--- Pushed Routes ---#
        list push    'route 192.168.1.0 255.255.255.0'
        list push    'dhcp-option DNS 192.168.1.1'
        list push    'dhcp-option WINS 192.168.1.1'
This is all wrong because you do not have a 192.168.1.0/24 subnet.

Mean wroteThe bold marked ips do not match mine, but if I adjust them to 10.50.50.0 and 10.50.50.1, they are overwritten again after router restart.
Please see the openwrt documentation.

I adjusted them to 10.50.50. and left the last value as in my quote above. Now it looks like #--- Routes ---#
option server '10.1.1.0 255.255.255.0'
option ifconfig '10.1.1.1 255.255.255.0'

#--- Client Config ---#
option client_config_dir '/etc/openvpn/clients/'

#--- Pushed Routes ---#
list push 'route 10.50.50.0 255.255.255.0'
list push 'dhcp-option DNS 10.50.50.1'
list push 'dhcp-option WINS 10.50.50.1'
list push 'dhcp-option DNS 10.1.1.1'
# list push 'dhcp-option DNS 8.8.4.4'
list push 'dhcp-option NTP 129.6.15.30'
list push 'redirect-gateway local def1' I also followed your first link and changed

"redirect-gateway def1"

"redirect-gateway local def1"

and

push "dhcp-option DNS 8.8.8.8"

push "dhcp-option DNS 10.1.1.1"

I ran

iptables -t nat -A POSTROUTING -s 10.1.1.0/24 -o eth0 -j MASQUERADE

on my openwrt.

Nevertheless I cannot connect anymore from my iphone with my (old) certificates over the openvpn client. Perhaps my iptables settings are the reason? Even if there are many entries with openvpn that are suffixed with ACCEPT

# Generated by iptables-save v1.4.21 on Tue Jul 26 22:54:43 2016
*nat
:PREROUTING ACCEPT [448:55532]
:INPUT ACCEPT [48:4374]
:OUTPUT ACCEPT [188:14007]
:POSTROUTING ACCEPT [7:749]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpn_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpn_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_vpn_postrouting - [0:0]
:zone_vpn_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -m id --id 0x66773300 -m comment --comment "user chain for prerouting" -j prerouting_rule
-A PREROUTING -i tun0 -m id --id 0x66773300 -j zone_vpn_prerouting
-A PREROUTING -i tun0 -m id --id 0x66773300 -j zone_wan_prerouting
-A PREROUTING -i br-lan -m id --id 0x66773300 -j zone_lan_prerouting
-A PREROUTING -i eth1 -m id --id 0x66773300 -j zone_wan_prerouting
-A POSTROUTING -m id --id 0x66773300 -m comment --comment "user chain for postrouting" -j postrouting_rule
-A POSTROUTING -o tun0 -m id --id 0x66773300 -j zone_vpn_postrouting
-A POSTROUTING -o tun0 -m id --id 0x66773300 -j zone_wan_postrouting
-A POSTROUTING -o br-lan -m id --id 0x66773300 -j zone_lan_postrouting
-A POSTROUTING -o eth1 -m id --id 0x66773300 -j zone_wan_postrouting
-A zone_lan_postrouting -m id --id 0x66773300 -m comment --comment "user chain for postrouting" -j postrouting_lan_rule
-A zone_lan_postrouting -m id --id 0x66773300 -m comment --comment "user chain for postrouting" -j postrouting_lan_rule
-A zone_lan_prerouting -m id --id 0x66773300 -m comment --comment "user chain for prerouting" -j prerouting_lan_rule
-A zone_lan_prerouting -m id --id 0x66773300 -m comment --comment "user chain for prerouting" -j prerouting_lan_rule
-A zone_vpn_postrouting -m id --id 0x66773300 -m comment --comment "user chain for postrouting" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m id --id 0x66773300 -m comment --comment "user chain for postrouting" -j postrouting_vpn_rule
-A zone_vpn_postrouting -m id --id 0x66773300 -j MASQUERADE
-A zone_vpn_postrouting -m id --id 0x66773300 -j MASQUERADE
-A zone_vpn_prerouting -m id --id 0x66773300 -m comment --comment "user chain for prerouting" -j prerouting_vpn_rule
-A zone_vpn_prerouting -m id --id 0x66773300 -m comment --comment "user chain for prerouting" -j prerouting_vpn_rule
-A zone_wan_postrouting -m id --id 0x66773300 -m comment --comment "user chain for postrouting" -j postrouting_wan_rule
-A zone_wan_postrouting -m id --id 0x66773300 -m comment --comment "user chain for postrouting" -j postrouting_wan_rule
-A zone_wan_postrouting -m id --id 0x66773300 -j MASQUERADE
-A zone_wan_postrouting -m id --id 0x66773300 -j MASQUERADE
-A zone_wan_prerouting -m id --id 0x66773300 -m comment --comment "user chain for prerouting" -j prerouting_wan_rule
-A zone_wan_prerouting -m id --id 0x66773300 -m comment --comment "user chain for prerouting" -j prerouting_wan_rule
COMMIT
# Completed on Tue Jul 26 22:54:43 2016
# Generated by iptables-save v1.4.21 on Tue Jul 26 22:54:43 2016
*raw
:PREROUTING ACCEPT [3318:1119908]
:OUTPUT ACCEPT [505:67809]
COMMIT
# Completed on Tue Jul 26 22:54:43 2016
# Generated by iptables-save v1.4.21 on Tue Jul 26 22:54:43 2016
*mangle
:PREROUTING ACCEPT [3280:1113830]
:INPUT ACCEPT [1411:317022]
:FORWARD ACCEPT [1558:751452]
:OUTPUT ACCEPT [475:65035]
:POSTROUTING ACCEPT [2017:815739]
-A FORWARD -o tun0 -p tcp -m id --id 0x66773300 -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o eth1 -p tcp -m id --id 0x66773300 -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Tue Jul 26 22:54:43 2016
# Generated by iptables-save v1.4.21 on Tue Jul 26 22:54:43 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_DROP - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_DROP - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m id --id 0x66773300 -j ACCEPT
-A INPUT -m id --id 0x66773300 -m comment --comment "user chain for input" -j input_rule
-A INPUT -m id --id 0x66773300 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m id --id 0x66773300 -m conntrack --ctstate INVALID -j DROP
-A INPUT -p tcp -m id --id 0x66773300 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
-A INPUT -p tcp -m id --id 0x66773300 -m tcp --dport 1194 -m comment --comment "Allow Inbound VPN0" -j ACCEPT
-A INPUT -p udp -m id --id 0x66773300 -m udp --dport 1194 -m comment --comment "Allow Inbound VPN0" -j ACCEPT
-A INPUT -s 10.1.1.0/24 -d 10.50.50.0/26 -p tcp -m id --id 0x66773300 -m comment --comment "Allow Inbound VPN0 Traffic to LAN" -j ACCEPT
-A INPUT -s 10.1.1.0/24 -d 10.50.50.0/26 -p udp -m id --id 0x66773300 -m comment --comment "Allow Inbound VPN0 Traffic to LAN" -j ACCEPT
-A INPUT -i tun0 -m id --id 0x66773300 -j zone_vpn_input
-A INPUT -i tun0 -m id --id 0x66773300 -j zone_wan_input
-A INPUT -i br-lan -m id --id 0x66773300 -j zone_lan_input
-A INPUT -i eth1 -m id --id 0x66773300 -j zone_wan_input
-A FORWARD -m id --id 0x66773300 -m comment --comment "user chain for forwarding" -j forwarding_rule
-A FORWARD -m id --id 0x66773300 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m id --id 0x66773300 -m conntrack --ctstate INVALID -j DROP
-A FORWARD -s 10.1.1.0/24 -d 10.50.50.0/26 -p tcp -m id --id 0x66773300 -m comment --comment "Allow Forwarded VPN0 Traffic to LAN" -j ACCEPT
-A FORWARD -s 10.1.1.0/24 -d 10.50.50.0/26 -p udp -m id --id 0x66773300 -m comment --comment "Allow Forwarded VPN0 Traffic to LAN" -j ACCEPT
-A FORWARD -s 10.1.1.0/24 -p icmp -m id --id 0x66773300 -m comment --comment "Allow Inbound ICMP Traffic from VPN0 to LAN" -j zone_lan_dest_ACCEPT
-A FORWARD -s 10.1.1.0/24 -p icmp -m id --id 0x66773300 -m icmp --icmp-type 8 -m comment --comment "Allow Outbound ICMP Echo Request (8) from VPN0" -j zone_wan_dest_ACCEPT
-A FORWARD -i tun0 -m id --id 0x66773300 -j zone_vpn_forward
-A FORWARD -i tun0 -m id --id 0x66773300 -j zone_wan_forward
-A FORWARD -i br-lan -m id --id 0x66773300 -j zone_lan_forward
-A FORWARD -i eth1 -m id --id 0x66773300 -j zone_wan_forward
-A FORWARD -m id --id 0x66773300 -j reject
-A OUTPUT -o lo -m id --id 0x66773300 -j ACCEPT
-A OUTPUT -m id --id 0x66773300 -m comment --comment "user chain for output" -j output_rule
-A OUTPUT -m id --id 0x66773300 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m id --id 0x66773300 -m conntrack --ctstate INVALID -j DROP
-A OUTPUT -o tun0 -m id --id 0x66773300 -j zone_vpn_output
-A OUTPUT -o tun0 -m id --id 0x66773300 -j zone_wan_output
-A OUTPUT -o br-lan -m id --id 0x66773300 -j zone_lan_output
-A OUTPUT -o eth1 -m id --id 0x66773300 -j zone_wan_output
-A reject -p tcp -m id --id 0x66773300 -j REJECT --reject-with tcp-reset
-A reject -m id --id 0x66773300 -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m id --id 0x66773300 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
-A syn_flood -m id --id 0x66773300 -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m id --id 0x66773300 -j ACCEPT
-A zone_lan_forward -m id --id 0x66773300 -m comment --comment "user chain for forwarding" -j forwarding_lan_rule
-A zone_lan_forward -m id --id 0x66773300 -m comment --comment "user chain for forwarding" -j forwarding_lan_rule
-A zone_lan_forward -m id --id 0x66773300 -m comment --comment "forwarding lan -> wan" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m id --id 0x66773300 -m comment --comment "forwarding lan -> vpn" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_lan_forward -m id --id 0x66773300 -j zone_lan_dest_ACCEPT
-A zone_lan_forward -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_lan_forward -m id --id 0x66773300 -j zone_lan_dest_ACCEPT
-A zone_lan_input -m id --id 0x66773300 -m comment --comment "user chain for input" -j input_lan_rule
-A zone_lan_input -m id --id 0x66773300 -m comment --comment "user chain for input" -j input_lan_rule
-A zone_lan_input -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_lan_input -m id --id 0x66773300 -j zone_lan_src_ACCEPT
-A zone_lan_input -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_lan_input -m id --id 0x66773300 -j zone_lan_src_ACCEPT
-A zone_lan_output -m id --id 0x66773300 -m comment --comment "user chain for output" -j output_lan_rule
-A zone_lan_output -m id --id 0x66773300 -m comment --comment "user chain for output" -j output_lan_rule
-A zone_lan_output -m id --id 0x66773300 -j zone_lan_dest_ACCEPT
-A zone_lan_output -m id --id 0x66773300 -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m id --id 0x66773300 -j ACCEPT
-A zone_vpn_dest_ACCEPT -o tun0 -m id --id 0x66773300 -j ACCEPT
-A zone_vpn_forward -m id --id 0x66773300 -m comment --comment "user chain for forwarding" -j forwarding_vpn_rule
-A zone_vpn_forward -m id --id 0x66773300 -m comment --comment "user chain for forwarding" -j forwarding_vpn_rule
-A zone_vpn_forward -m id --id 0x66773300 -m comment --comment "forwarding vpn -> lan" -j zone_lan_dest_ACCEPT
-A zone_vpn_forward -m id --id 0x66773300 -m comment --comment "forwarding vpn -> wan" -j zone_wan_dest_ACCEPT
-A zone_vpn_forward -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_vpn_forward -m id --id 0x66773300 -j zone_vpn_dest_ACCEPT
-A zone_vpn_forward -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_vpn_forward -m id --id 0x66773300 -j zone_vpn_dest_ACCEPT
-A zone_vpn_input -m id --id 0x66773300 -m comment --comment "user chain for input" -j input_vpn_rule
-A zone_vpn_input -m id --id 0x66773300 -m comment --comment "user chain for input" -j input_vpn_rule
-A zone_vpn_input -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_vpn_input -m id --id 0x66773300 -j zone_vpn_src_ACCEPT
-A zone_vpn_input -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_vpn_input -m id --id 0x66773300 -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m id --id 0x66773300 -m comment --comment "user chain for output" -j output_vpn_rule
-A zone_vpn_output -m id --id 0x66773300 -m comment --comment "user chain for output" -j output_vpn_rule
-A zone_vpn_output -m id --id 0x66773300 -j zone_vpn_dest_ACCEPT
-A zone_vpn_output -m id --id 0x66773300 -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -m id --id 0x66773300 -j ACCEPT
-A zone_wan_dest_ACCEPT -o tun0 -m id --id 0x66773300 -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth1 -m id --id 0x66773300 -j ACCEPT
-A zone_wan_dest_DROP -o eth1 -m id --id 0x66773300 -j DROP
-A zone_wan_dest_DROP -o tun0 -m id --id 0x66773300 -j DROP
-A zone_wan_dest_REJECT -o eth1 -m id --id 0x66773300 -j reject
-A zone_wan_forward -m id --id 0x66773300 -m comment --comment "user chain for forwarding" -j forwarding_wan_rule
-A zone_wan_forward -m id --id 0x66773300 -m comment --comment "user chain for forwarding" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m id --id 0x66773300 -m comment --comment "@rule[12]" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m id --id 0x66773300 -m udp --dport 500 -m comment --comment "@rule[13]" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_wan_forward -m id --id 0x66773300 -j zone_wan_dest_DROP
-A zone_wan_forward -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_wan_forward -m id --id 0x66773300 -j zone_wan_dest_REJECT
-A zone_wan_input -m id --id 0x66773300 -m comment --comment "user chain for input" -j input_wan_rule
-A zone_wan_input -m id --id 0x66773300 -m comment --comment "user chain for input" -j input_wan_rule
-A zone_wan_input -p udp -m id --id 0x66773300 -m udp --dport 68 -m comment --comment Allow-DHCP-Renew -j ACCEPT
-A zone_wan_input -p icmp -m id --id 0x66773300 -m icmp --icmp-type 8 -m comment --comment Allow-Ping -j ACCEPT
-A zone_wan_input -p igmp -m id --id 0x66773300 -m comment --comment Allow-IGMP -j ACCEPT
-A zone_wan_input -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_wan_input -m id --id 0x66773300 -j zone_wan_src_DROP
-A zone_wan_input -m id --id 0x66773300 -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_wan_input -m id --id 0x66773300 -j zone_wan_src_REJECT
-A zone_wan_output -m id --id 0x66773300 -m comment --comment "user chain for output" -j output_wan_rule
-A zone_wan_output -m id --id 0x66773300 -m comment --comment "user chain for output" -j output_wan_rule
-A zone_wan_output -m id --id 0x66773300 -j zone_wan_dest_ACCEPT
-A zone_wan_output -m id --id 0x66773300 -j zone_wan_dest_ACCEPT
-A zone_wan_src_DROP -i eth1 -m id --id 0x66773300 -j DROP
-A zone_wan_src_DROP -i tun0 -m id --id 0x66773300 -j DROP
-A zone_wan_src_REJECT -i eth1 -m id --id 0x66773300 -j reject
COMMIT
# Completed on Tue Jul 26 22:54:43 2016

Thanks and kind regards,

Dirk

Mean

An additional info: I had to enable bridge firewalling (as written in openwrt docu https://wiki.openwrt.org/doc/howto/netfilter#iptables):

In OpenWrt bridge firewalling is disabled by default. It can be enabled by editing /etc/sysctl.conf

Now I can connect again with the openvpn but not with the internet.

Mean

When I check the openvpn iphone app console, I see: Error parsing dhcp-option: [dhcp-option][WINS][10.50.50.1] : tun_prod_dhcp_option_error: tun_builder_add_wins_server failed
Unknown pushed DHCP option [dhcp-option][NTP][129.6.16.30]

So I removed

list push 'dhcp-option WINS 10.50.50.1'
list push 'dhcp-option DNS 8.8.4.4' -> entry with 8.8.8.8 is still available
list push 'dhcp-option NTP 129.6.15.30'

I now can connect to my vpn without errors, but through the vpn not with the internet.

Mean

Since I deleted most of my (sometimes duplicate) firewall rules it works. So this was the reason and I now have to re-setup my firewall.

TinCanTech

Great .. Thanks for letting us know your solution 8-)