Hello. I will try to make myself usefull.
Something I'm not certain:
iptables -I FORWARD -i br0 -o tun1 -j ACCEPT
iptables -I FORWARD -i tun1 -o br0 -j ACCEPT
Can't this be done in one line?
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
You don't need this on client side, because you don't have any services there so accepting to nowhere on this ports may be a secuirity. Accepting external acess to tcp,udp 1194 is needed only where OpenVPN server is installed. When the tunnel will work fine, you will have to remove one input: tcp or udp, that you will not use.
Do a good understanding and confirming:
Serves LAN IP pool is 192.168.1.0.
Client 1 LAN IP pool is 192.168.0.0
Client 2 LAN IP pool is 192.168.2.0
Do you use same certificate on clients? Common name used to generate the certificates for clients are different?
Do you want to route IPv6? Are you using IPv6? If not, remove "tun-ipv6" from config for now. When all will work fine - you could practice with it.
Your clients does not recive route option for accessing other client. In routing table of client 1 you have to have
192.168.2.0 192.168.66.5 255.255.255.0 UG 0 0 0 tun1
On client 2 you have to have
192.168.0.0 192.168.66.5 255.255.255.0 UG 0 0 0 tun1
That's why you clients cant see each other.
In you server's config you have:
push "route 192.168.0.0 255.255.255.0" # Give client 2 aware of LAN on client 1, which seems does not work
push "route 192.168.1.0 255.255.255.0" # Give clients aware of server's LAN, which work
push "route 192.168.2.0 255.255.255.0" # Give client 1 aware of LAN on client 2, which seems does not work
route 192.168.2.0 255.255.255.0 # Give server aware of client's 2 LAN
route 192.168.0.0 255.255.255.0 # Give server aware of client's 1 LAN
But in order to have real routes work, you have to create in that ccd folder to files with COMMON NAME givet to client 1 and client 2 when creating the certificates for them.
In file with common name of client 1 you have to write only:
iroute 192.168.0.0 255.255.255.0
In file with common name of client 2 you have to write only:
iroute 192.168.2.0 255.255.255.0
Not both "iroute" in both files.
It's more about on clients not all routes are added. You have to leave those "route" and "push route" in first server config you have and show the connection log of each client and server, to find where the routes af LAN's pool are failing.
