OpenVPN on Gentoo VPS: no internet access

equaeghe

I have set up OpenVPN 2.4.7 on a Gentoo VPS. Connecting from the client works, but I have no internet access. Pinging 8.8.8.8 does not return anything and webpages time out. I also do not get a reply when I ping 10.8.0.1 (the server's ‘local’ ip, AFAIU), which is supposed to be reachable.
I strongly suspect this is a server misconfiguration issue, as I have the same problem from two different clients (Gentoo laptop, android phone). Both those clients work with a very similarly configured OpenVPN server on an Ubuntu 16.04 VPS (with older version of openvpn, 2.3.10).
I would be grateful for any help in diagnosing and fixing this.

# server binding port
port 1194

# openvpn protocol, could be tcp / udp / tcp6 / udp6
proto udp

# tun/tap device
dev tun

# keys configuration, use generated keys
ca /etc/pki/ca.crt
cert equaeghe-VPN.crt
key private/equaeghe-VPN.key
dh /etc/pki/dh.pem

# force secure digest(?)
auth SHA512

# optional tls-auth key to secure identifying
tls-auth ta.key 0

# OpenVPN 'virtual' network infomation, network and mask
topology subnet
server 10.8.0.0 255.255.255.0

# persistent device and key settings
persist-key
persist-tun
ifconfig-pool-persist ipp.txt

# If enabled, this directive will configure all clients to redirect their default
# network gateway through the VPN, causing all IP traffic such as web browsing and
# and DNS lookups to go through the VPN.
# (The OpenVPN server machine may need to NAT or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
push "redirect-gateway def1 bypass-dhcp"

client-config-dir ccd
route 192.168.178.0 255.255.255.0

# Certain Windows-specific network settings can be pushed to clients, such as DNS
# or WINS server addresses.
push "dhcp-option DNS <dns server 1 ip>"
push "dhcp-option DNS <dns server 2 ip>"

# connection
keepalive 10 120

# For compression compatible with older clients use comp-lzo.
# If you enable it here, you must also enable it in the client config file.
comp-lzo no

# It's a good idea to reduce the OpenVPN daemon's privileges after initialization.
user nobody
group nobody

# logging
verb 3

# Output a short status file showing current connections, truncated and rewritten every minute.
status /var/log/openvpn-status.log

# Silence repeating messages.
# At most 20 sequential messages of the same message category will be output to the log.
;mute 20

# Notify the client that when the server restarts so it
# can automatically reconnect.
;explicit-exit-notify 1

iroute 192.168.178.0 255.255.255.0

(This was needed for an issue that preceded the one I'm currently facing.)

client
remote <server ip>
port 1194
proto udp
dev tun
auth SHA512
persist-key
persist-tun
comp-lzo no
user nobody
group nobody
key-direction 1
script-security 2

server ‘ip route’ output:

default via <server ip> dev ens3 proto static
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
192.168.178.0/24 via 10.8.0.2 dev tun0
<server subnet>/23 dev ens3 proto kernel scope link src <server subnet>

Client ‘ip route’ output when connected:

default via 10.8.0.1 dev tun0 proto static metric 50 
default via 192.168.178.1 dev enp0s25 proto dhcp metric 100 
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.4 metric 50 
192.168.178.0/24 dev enp0s25 proto kernel scope link src 192.168.178.53 metric 100 
192.168.178.1 dev enp0s25 proto static scope link metric 100 
<server ip> via 192.168.178.1 dev enp0s25 proto static metric 100

(This is exactly the same as for the working installation, apart from the different server ip address.)

MULTI: multi_create_instance called
<client modem ip>:50207 Re-using SSL/TLS context
<client modem ip>:50207 Control Channel MTU parms [ L:1622 D:1140 EF:110 EB:0 ET:0 EL:3 ]
<client modem ip>:50207 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 AF:3/1 ]
<client modem ip>:50207 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1586,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA512,keysi>
<client modem ip>:50207 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1586,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SH>
<client modem ip>:50207 TLS: Initial packet from [AF_INET]<client ip>:50207, sid=10a6d1e2 76be5fe4
<client modem ip>:50207 VERIFY OK: depth=1, CN=equaeghe-CA
<client modem ip>:50207 VERIFY OK: depth=0, CN=eq
<client modem ip>:50207 peer info: IV_VER=2.4.7
<client modem ip>:50207 peer info: IV_PLAT=linux
<client modem ip>:50207 peer info: IV_PROTO=2
<client modem ip>:50207 peer info: IV_NCP=2
<client modem ip>:50207 peer info: IV_LZO=1
<client modem ip>:50207 peer info: IV_COMP_STUB=1
<client modem ip>:50207 peer info: IV_COMP_STUBv2=1
<client modem ip>:50207 peer info: IV_TCPNL=1
<client modem ip>:50207 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
<client modem ip>:50207 [eq] Peer Connection Initiated with [AF_INET]85.148.254.55:50207
<client modem ip>:50207 OPTIONS IMPORT: reading client specific options from: ccd/eq
<client modem ip>:50207 MULTI_sva: pool returned IPv4=10.8.0.4, IPv6=(Not enabled)
<client modem ip>:50207 MULTI: Learn: 10.8.0.4 -> eq/<client modem ip>:50207
<client modem ip>:50207 MULTI: primary virtual IP for eq/<client modem ip>:50207: 10.8.0.4
<client modem ip>:50207 MULTI: internal route 192.168.178.0/24 -> eq/<client modem ip>:50207
<client modem ip>:50207 MULTI: Learn: 192.168.178.0/24 -> eq/<client modem ip>.55:50207
eq/<client modem ip>:50207 PUSH: Received control message: 'PUSH_REQUEST'
eq/<client modem ip>:50207 SENT CONTROL [eq]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS <dns server 1 ip>,dhcp-option <dns server 2 ip>,route-ga>
eq/<client modem ip>:50207 Data Channel: using negotiated cipher 'AES-256-GCM'
eq/<client modem ip>:50207 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 AF:3/1 ]
eq/<client modem ip>:50207 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
eq/<client modem ip>:50207 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
eq/<client modem ip>:50207 MULTI: Learn: 192.168.178.53 -> eq/<client modem ip>:50207
eq/<client modem ip>:50207 PID_ERR replay-window backtrack occurred [1] [SSL-0] [0_0000] 0:6 0:5 t=1585926752[0] r=[0,64,15,1,1] sl=[58,6,64,528]

The last line is one that may be suspicious, but may also be harmless, I don't know.

My server firewall opens the appropriate port (not a surprise, as a connection is made) and is also set to masquerade:

# firewall-cmd --list-all
public (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: ens3
  sources:
  services: http https openvpn ssh
  ports:
  protocols:
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
        rule family="ipv6" source ipset="sshguard6" drop
        rule family="ipv4" source ipset="sshguard4" drop

Forwarding is enabled:

# cat /proc/sys/net/ipv4/conf/all/forwarding
1

equaeghe

It was the firewall. I needed to add the tun0 interface to a zone (I chose dmz, but that was not important):

dmz (active)
  target: default
  icmp-block-inversion: no
  interfaces: tun0
  sources: 
  services: ssh-55555
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: