OpenVPN and relayd issues

mindless

Hi,

I have an OpenVPN server running on OpenWrt with the following version:

root@OpenWrt:~# openvpn --version
OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 31 2016
library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08

This OpenWrt box is connected to my home WiFi (SSID1) network (192.168.1.0/24) in sta mode and also acts as an Access Point as a WiFi repeater using relayd on SSID_Repeater.
This works fine and I can connect with my OpenVPN clients and use my home Internet connection from them. The problem is that once the VPN is up, I can only access clients connected to SSID_Repeater while I can't access those connected to SSID1.

The firewall rules on my server are:

iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 192.168.1.6

And these are the commands pushed on the clients:

Tue Dec 27 22:51:38 2016 us=205442 /sbin/ip link set dev tun0 up mtu 1500
Tue Dec 27 22:51:38 2016 us=219966 /sbin/ip addr add dev tun0 local 10.8.0.10 peer 10.8.0.9
Tue Dec 27 22:51:38 2016 us=226530 /sbin/ip route add <mypublicIP>/32 via 192.168.0.1
Tue Dec 27 22:51:38 2016 us=233256 /sbin/ip route del 0.0.0.0/0
Tue Dec 27 22:51:38 2016 us=244558 /sbin/ip route add 0.0.0.0/0 via 10.8.0.9
Tue Dec 27 22:51:38 2016 us=250748 /sbin/ip route add 192.168.1.0/24 via 10.8.0.9
Tue Dec 27 22:51:38 2016 us=256589 /sbin/ip route add 10.8.0.1/32 via 10.8.0.9

Althoug this question may not be particularly related to OpenVPN I'd very much appreciate any help or ideas if you have faced this issue before.

Thanks a lot!

mindless

This is the tcpdump output on the tun interface in the OpenVPN server side when pinging the IP address of the VPN server in the WiFi network from the VPN client:

root@OpenWrt:~# tcpdump -i tun0 -v "icmp or arp" -vv -en
tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
22:44:22.268116 ip: (tos 0x0, ttl 64, id 31762, offset 0, flags [DF], proto ICMP (1), length 84)
    10.8.0.10 > 192.168.1.6: ICMP echo request, id 21892, seq 9, length 64
22:44:22.268334 ip: (tos 0x0, ttl 64, id 60613, offset 0, flags [none], proto ICMP (1), length 84)
    192.168.1.6 > 10.8.0.10: ICMP echo reply, id 21892, seq 9, length 64

However, if I ping my router (192.168.1.1) from the VPN client I got no replies:

root@OpenWrt:~# tcpdump -i tun0 -v "icmp or arp" -vv -en
tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
22:47:10.177555 ip: (tos 0x0, ttl 64, id 58689, offset 0, flags [DF], proto ICMP (1), length 84)
    10.8.0.10 > 192.168.1.1: ICMP echo request, id 21930, seq 1, length 64
22:47:11.183680 ip: (tos 0x0, ttl 64, id 58691, offset 0, flags [DF], proto ICMP (1), length 84)
    10.8.0.10 > 192.168.1.1: ICMP echo request, id 21930, seq 2, length 64

mindless

I'm posting both configuration files. Your wise advises are very much appreciated 🙂
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-options DNS 8.8.8.8"
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 6 client
dev tun
proto udp
remote xxxx 1194
comp-lzo
redirect-gateway
<ca>
-----BEGIN CERTIFICATE-----
xxxx
-----END CERTIFICATE-----
</ca>
nobind
persist-key
persist-tun
user nobody
group nogroup
resolv-retry infinite
verb 6