[ziobabba]

Buongiorno a tutti
ho provato a configurare il DGA4130 con la guida di NORDVPN in link https://nordvpn.com/it/tutorials/openwrt/openvpn/
Sembra che il router si connetta come client al server il quale gli assegna l'indirizzo IP ma non si riesce a navigare. Secondo me c'è qualcosa nella sezione firewall o portforwarding che non va molto bene.
Qualcuno ha avuto lo stessso problema?
Per vostra comodità ho installato sul router l'ultima versione della GUI 9.0.14 e lestensione luci ( ma sembra ci si faccia poco in termini VPN)
Grazie in anticipo per tutte le risposte/dritte   
CIao
Zio

[nclmrc]

prova a postare i file network e firewall.

[ziobabba]

Per comodità solo le parti aggiunte.
Se poi serve tutto il file li copio

questo quello aggiunto su etc/config/network

Codice: [Seleziona]

config interface 'wan'
option auto '1'
option proto 'pppoe'
option demand '0'
option password 'alicenewag'
option macaddr 'xx:xx:xx:xx:xx:xx'
option ipv6 '0'
option reqopts '1 3 6 15 33 42 51 121 249'
option keepalive_adaptive '0'
option dns_metric '0'
option ifname 'wanptm0'
option username '[email protected]'
[b]option peerdns '0'
        list dns '8.8.8.8'
        list dns '8.8.4.4'[/b]
config interface 'nordvpntun'
        option proto 'none'
        option ifname 'tun0'
qui quelo su /etc/config/firewall

Codice: [Seleziona]

config zone
        option name 'vpnfirewall'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'nordvpntun'

config forwarding
        option src 'lan'
        option dest 'vpnfirewall'

Grazie in anticipo

[fabiobassa]

@ziobabba

Zio dai questi due comandi da linea di comando:

Codice: [Seleziona]

routee

Codice: [Seleziona]

traceroute -d 8.8.8.8e anche ifconfig
e posta risultati

[ziobabba]

Ciao Fabio
perdona il ritardo ma finesettimana lungo  :D

come mi hai chiesto ti mando il risultato dei comandi

Codice: [Seleziona]

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.7.7.1        128.0.0.0       UG    0      0        0 tun0
default         192.168.100.1   0.0.0.0         UG    0      0        0 pppoe-wan
10.7.7.0        *               255.255.255.0   U     0      0        0 tun0
82.102.21.75    192.168.100.1   255.255.255.255 UGH   0      0        0 pppoe-wan
128.0.0.0       10.7.7.1        128.0.0.0       UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     0      0        0 br-lan
192.168.100.1   *               255.255.255.255 UH    0      0        0 pppoe-wan
192.168.168.0   *               255.255.255.128 U     0      0        0 wl0_1
192.168.168.128 *               255.255.255.128 U     0      0        0 wl1_1
239.0.0.0       *               255.0.0.0       U     0      0        0 br-lan

Codice: [Seleziona]

traceroute -d 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 38 byte packets
 1  10.7.7.1 (10.7.7.1)  58.210 ms  93.563 ms  154.387 ms
 2  185.183.105.25 (185.183.105.25)  140.426 ms  245.691 ms  510.261 ms
 3  213.242.125.73 (213.242.125.73)  1295.631 ms  81.397 ms  137.915 ms
 4  4.69.143.145 (4.69.143.145)  293.629 ms  4.69.143.137 (4.69.143.137)  120.443 ms  4.69.143.133 (4.69.143.133)  103.163 ms
 5  72.14.243.102 (72.14.243.102)  78.016 ms  383.039 ms  292.705 ms
 6  108.170.245.65 (108.170.245.65)  181.500 ms  108.170.245.81 (108.170.245.81)  189.031 ms  429.064 ms
 7  74.125.252.1 (74.125.252.1)  387.530 ms  216.239.58.21 (216.239.58.21)  168.882 ms  209.85.249.123 (209.85.249.123)  379.246 ms
 8  8.8.8.8 (8.8.8.8)  122.474 ms  449.987 ms  362.589 ms

Codice: [Seleziona]

ifconfig
 bcmsw     Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1339175 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1280511 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:474873388 (452.8 MiB)  TX bytes:339166293 (323.4 MiB)
          Base address:0xffff

br-lan    Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:11294538 errors:0 dropped:18 overruns:0 frame:0
          TX packets:15458174 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:3400612081 (3.1 GiB)  TX bytes:2443003944 (2.2 GiB)

eth0      Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8643352 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5200761 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3294503237 (3.0 GiB)  TX bytes:473195221 (451.2 MiB)


eth1      Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:329629 errors:0 dropped:0 overruns:0 frame:0
          TX packets:406640 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:70014051 (66.7 MiB)  TX bytes:86680450 (82.6 MiB)


eth2      Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1403729 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2929994 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:109322664 (104.2 MiB)  TX bytes:4226987327 (3.9 GiB)


eth3      Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:79383 errors:0 dropped:0 overruns:0 frame:0
          TX packets:190503 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27586260 (26.3 MiB)  TX bytes:129476249 (123.4 MiB)


eth5      Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:64196 errors:0 dropped:10 overruns:0 frame:0
          TX packets:141968 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5076656 (4.8 MiB)  TX bytes:44584774 (42.5 MiB)


lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:577 errors:0 dropped:0 overruns:0 frame:0
          TX packets:577 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:51520 (50.3 KiB)  TX bytes:51520 (50.3 KiB)

pppoe-wan Link encap:Point-to-Point Protocol
          inet addr:79.17.75.14  P-t-P:192.168.100.1  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:14805303 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10532472 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:2088595228 (1.9 GiB)  TX bytes:3254470181 (3.0 GiB)

ptm0      Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          inet6 addr: fe80::1213:31ff:fe71:8ee8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:14808660 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10535869 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2473735696 (2.3 GiB)  TX bytes:3483544366 (3.2 GiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.7.7.77  P-t-P:10.7.7.77  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:84854 errors:0 dropped:0 overruns:0 frame:0
          TX packets:86099 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:5936670 (5.6 MiB)  TX bytes:6034428 (5.7 MiB)

wanptm0   Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:129898 errors:0 dropped:0 overruns:0 frame:0
          TX packets:476157 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:34902930 (33.2 MiB)  TX bytes:318926638 (304.1 MiB)

wl0       Link encap:Ethernet  HWaddr 10:13:31:71:8E:E9
          inet6 addr: fe80::1213:31ff:fe71:8ee9/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:890799 errors:0 dropped:0 overruns:0 frame:334474
          TX packets:7223054 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:96032798 (91.5 MiB)  TX bytes:2026702201 (1.8 GiB)
          Interrupt:92

wl0_1     Link encap:Ethernet  HWaddr 10:13:31:71:8E:E9
          inet addr:192.168.168.1  Bcast:192.168.168.127  Mask:255.255.255.128
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:334474
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wl1_1     Link encap:Ethernet  HWaddr 10:13:31:71:8E:E8
          inet addr:192.168.168.129  Bcast:192.168.168.255  Mask:255.255.255.128
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

[fabiobassa]

Perfetto. Come puoi assolutamente vedere il router in se naviga.. infatti il traceroute va in porto ( l ottavo salto é la destinazione chiesta 8.8.8.8 e il primo hop é la subnet di nordvpn che é 10.7.7.1.
L ip che nordvpn ti ha assegnato sulla VPN ( tun0) é 10.7.7.77

Dal momento che é tutto a posto da un punto di vista di routing mi viene da pensare che manchi qualche masquerade e qualche forward nel firewall

Vuoi postare il contenuto di /etc/config/firewall ?

[ziobabba]

ecco il file

Codice: [Seleziona]

config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option drop_invalid '1'

config zone 'lan'
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option mtu_fix '1'
option wan '0'

config zone 'wan'
option name 'wan'
list network 'wan'
list network 'wan6'
list network 'wwan'
option input 'DROP'
option output 'ACCEPT'
option forward 'DROP'
option masq '1'
option conntrack '1'
option mtu_fix '1'
option wan '1'

config forwarding 'lan_wan'
option src 'lan'
option dest 'wan'

config zone 'z_wlnetb24'
option name 'z_wlnetb24'
list network 'wlnet_b_24'
option input 'DROP'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
option wan '0'

config forwarding 'for_wlnetb24'
option src 'z_wlnetb24'
option dest 'wan'

config rule 'Drop_non_TCP_SYN'
option name 'Drop_non_TCP_SYN'
option src 'wan'
option dest '*'
option proto 'tcp'
option target 'DROP'
option extra '! --tcp-flags ALL SYN'

config rule 'drop_lan_2_z_wlnetb24'
option name 'drop_lan_2_z_wlnetb24'
option src 'lan'
option dest 'z_wlnetb24'
option proto 'all'
option target 'DROP'

config rule 'drop_z_wlnetb24_2_lan'
option name 'drop_z_wlnetb24_2_lan'
option src 'z_wlnetb24'
option dest 'lan'
option proto 'all'
option target 'DROP'

config rule 'drop_lan_2_z_wlnetb24_GW'
option name 'drop-lan_2_z_wlnetb24_GW'
option src 'lan'
option proto 'all'
option target 'DROP'
option family 'ipv4'
option dest_ip '192.168.168.1'

config rule 'Allow_z_wlnetb24_ICMP'
option name 'Allow_z_wlnetb24_ICMP'
option src 'z_wlnetb24'
option proto 'igmp'
option target 'ACCEPT'
option family 'ipv4'
option dest_ip '192.168.168.1'

config rule 'Allow_z_wlnetb24_DHCP'
option name 'Allow_z_wlnetb24_DHCP'
option src 'z_wlnetb24'
option proto 'udp'
option dest_port '67'
option target 'ACCEPT'
option family 'ipv4'

config rule 'Allow_z_wlnetb24_DNS'
option name 'Allow_z_wlnetb24_DNS'
option src 'z_wlnetb24'
option proto 'udp'
option dest_port '53'
option target 'ACCEPT'
option family 'ipv4'

config rule 'Allow_z_wlnetb24_ICMPv6'
option name 'Allow-z_wlnetb24_ICMPv6'
option src 'z_wlnetb24'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config zone 'z_wlnetb5'
option name 'z_wlnetb5'
list network 'wlnet_b_5'
option input 'DROP'
option output 'ACCEPT'
option forward 'REJECT'
option wan '0'

config forwarding 'for_wlnetb5'
option src 'z_wlnetb5'
option dest 'wan'

config rule 'drop_lan_2_z_wlnetb5'
option name 'drop_lan_2_z_wlnetb5'
option src 'lan'
option dest 'z_wlnetb5'
option proto 'all'
option target 'DROP'

config rule 'drop_z_wlnetb5_2_lan'
option name 'drop_z_wlnetb5_2_lan'
option src 'z_wlnetb5'
option dest 'lan'
option proto 'all'
option target 'DROP'

config rule 'drop_lan_2_z_wlnetb5_GW'
option name 'drop-lan_2_z_wlnetb5_GW'
option src 'lan'
option proto 'all'
option target 'DROP'
option family 'ipv4'
option dest_ip '192.168.168.129'

config rule 'Allow_z_wlnetb5_ICMP'
option name 'Allow_z_wlnetb5_ICMP'
option src 'z_wlnetb5'
option proto 'igmp'
option target 'ACCEPT'
option family 'ipv4'
option dest_ip '192.168.168.129'

config rule 'Allow_z_wlnetb5_DHCP'
option name 'Allow_z_wlnetb5_DHCP'
option src 'z_wlnetb5'
option proto 'udp'
option dest_port '67'
option target 'ACCEPT'
option family 'ipv4'

config rule 'Allow_z_wlnetb5_DNS'
option name 'Allow_z_wlnetb5_DNS'
option src 'z_wlnetb5'
option proto 'udp'
option dest_port '53'
option target 'ACCEPT'
option family 'ipv4'

config rule 'Allow_z_wlnetb5_ICMPv6'
option name 'Allow-z_wlnetb5_ICMPv6'
option src 'z_wlnetb5'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config zone 'public_lan'
option name 'public_lan'
list network 'public_lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option wan '0'
option log '1'
option log_limit '5/minute'

config forwarding 'public_lan_wan'
option src 'public_lan'
option dest 'wan'
option name 'subnet_out'
option enabled '1'

config forwarding 'wan_public_lan'
option src 'wan'
option dest 'public_lan'
option name 'subnet_in'
option enabled '1'

config rule 'rule1'
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule 'rule2'
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule 'rule3'
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule 'rule4'
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule 'rule5'
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule 'rule6'
option name 'access_2_LAN_IP'
option src 'lan'
option proto 'tcp'
option family 'ipv4'
option extra '-m multiport --dports 80,22,8080,443,8443 -m addrtype --limit-iface-in ! --dst-type LOCAL'
option target 'REJECT'

config rule 'rule7'
option name 'close_port_139'
option src 'wan'
option proto 'tcp'
option dest_port '139'
option family 'ipv4'
option target 'DROP'

config rule 'rule8'
option name 'close_port_445'
option src 'wan'
option proto 'tcp'
option dest_port '445'
option family 'ipv4'
option target 'DROP'

config rule 'rule9'
option name 'Deny-CUPS-lan'
option src 'lan'
option proto 'tcp'
option dest_port '631'
option family 'ipv4'
option target 'DROP'

config rule 'rule10'
option name 'Deny-CUPS-wan'
option src 'wan'
option proto 'tcp'
option dest_port '631'
option family 'ipv4'
option target 'DROP'

config rule 'rule11'
option name 'Deny-CUPS-lan-v6'
option src 'lan'
option proto 'tcp'
option dest_port '631'
option family 'ipv6'
option target 'DROP'

config rule 'rule12'
option name 'Deny-CUPS-wan-v6'
option src 'wan'
option proto 'tcp'
option dest_port '631'
option family 'ipv6'
option target 'DROP'

config rule 'rule13'
option name 'Allow-Ping6'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'

config rule 'SSH_wan'
option name 'SSH_wan'
option src 'wan'
option proto 'tcp'
option dest_port '22'
option target 'DROP'
option family 'ipv4'

config rule
option name 'Restrict-TCP-LAN-Input'
option src 'lan'
option dest_ip '!lan'
option proto 'tcp'
option family 'ipv4'
option extra '-m mark --mark 0/0x9000000'
option target 'REJECT'

config include
option path '/etc/firewall.user'

config include 'tchext_restart'
option type 'script'
option path '/lib/functions/firewall-restart-ext-tch.sh'

config include 'tchext'
option type 'script'
option path '/lib/functions/firewall-ext-tch.sh'
option reload '1'

config cone 'cone1'
option name 'PS and XBox Live 1'
option src 'wan'
option dest_port '88'

config cone 'cone2'
option name 'PS and XBox Live 2'
option src 'wan'
option dest_port '3074:3658'

config cone 'cone3'
option name 'PS and XBox Live 3'
option src 'wan'
option dest_port '10070'

config cone 'cone4'
option name 'PS and XBox Live 4'
option src 'wan'
option dest_port '4500'

config include 'tod'
option type 'script'
option path '/lib/functions/tod.sh'
option reload '1'

config include 'intercept'
option type 'script'
option path '/usr/lib/intercept/firewall.sh'

config fwconfig 'fwconfig'
option defaultoutgoing_lax 'ACCEPT'
option defaultoutgoing_normal 'ACCEPT'
option defaultoutgoing_high 'DROP'
option defaultoutgoing_user 'ACCEPT'
option defaultincoming_lax 'REJECT'
option defaultincoming_normal 'DROP'
option defaultincoming_high 'DROP'
option defaultincoming_user 'DROP'
option level 'normal'

config rulesgroup 'pinholerules'
option enabled '1'
option name 'FW rules for opening pinholes'
option type 'pinholerule'

config redirectsgroup 'userredirects'
option enabled '1'
option name 'FW redirects defined by the user'
option type 'userredirect'

config redirectsgroup 'dmzredirects'
option enabled '0'
option name 'FW redirects for the DMZ functionality'
option type 'dmzredirect'

config dmzredirect 'dmzredirect'
option name 'DMZ rule'
option src 'wan'
option dest 'lan'
option family 'ipv4'
option target 'DNAT'
option proto 'tcpudp'

config rulesgroup 'normalrules'
option enabled '1'
option name 'FW rules for normal level'
option type 'normalrule'

config rulesgroup 'laxrules'
option enabled '0'
option name 'FW rules for lax level'
option type 'laxrule'

config rulesgroup 'highrules'
option enabled '0'
option name 'FW rules for high level'
option type 'highrule'

config rulesgroup 'userrules'
option enabled '0'
option name 'FW rules for user level'
option type 'userrule'

config rulesgroup 'userrules_v6'
option enabled '0'
option name 'FW rules for user level IPv6'
option type 'userrule_v6'

config rulesgroup 'defaultrules'
option enabled '1'
option name 'FW rules for default behavior'
option type 'defaultrule'

config highrule 'highrule1'
option name 'HTTP'
option src 'lan'
option dest 'wan'
option proto 'tcp'
option dest_port '80'
option target 'ACCEPT'

config highrule 'highrule2'
option name 'HTTPS'
option src 'lan'
option dest 'wan'
option proto 'tcp'
option dest_port '443'
option target 'ACCEPT'

config highrule 'highrule3'
option name 'SMTP'
option src 'lan'
option dest 'wan'
option proto 'tcp'
option dest_port '25'
option target 'ACCEPT'

config highrule 'highrule4'
option name 'POP3'
option src 'lan'
option dest 'wan'
option proto 'tcp'
option dest_port '110'
option target 'ACCEPT'

config highrule 'highrule5'
option name 'IMAP'
option src 'lan'
option dest 'wan'
option proto 'tcp'
option dest_port '445'
option target 'ACCEPT'

config highrule 'highrule6'
option name 'SSH'
option src 'lan'
option dest 'wan'
option proto 'tcp'
option dest_port '22'
option target 'ACCEPT'

config defaultrule 'defaultipv6incoming'
option name 'Default action for incoming IPv6 traffic'
option src 'wan'
option dest 'lan'
option proto 'all'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'

config defaultrule 'defaultipv6outgoing'
option name 'Default action for outgoing IPv6 traffic'
option src 'lan'
option dest 'wan'
option proto 'all'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'

config defaultrule 'defaultoutgoing'
option name 'Default action for outgoing NAT'
option src 'lan'
option dest 'wan'
option proto 'all'
option target 'ACCEPT'

config helper 'ftphelper'
option helper 'ftp'
option dest_port '21'
option proto 'tcp'

config helper 'tftphelper'
option helper 'tftp'
option dest_port '69'
option proto 'udp'

config helper 'snmphelper'
option helper 'snmp'
option family 'ipv4'
option dest_port '161'
option proto 'udp'

config helper 'pptphelper'
option helper 'pptp'
option family 'ipv4'
option dest_port '1723'
option proto 'tcp'

config helper 'siphelper'
option enable '0'
option helper 'sip'
option dest_port '5060'
option proto 'udp'

config helper 'siploopback'
option helper 'sip'
option dest_port '5060'
option proto 'udp'
option intf 'loopback'

config helper 'irchelper'
option helper 'irc'
option family 'ipv4'
option dest_port '6667'
option proto 'tcp'

config helper 'amandahelper'
option helper 'amanda'
option dest_port '10080'
option proto 'udp'

config helper 'rtsphelper'
option helper 'rtsp'
option dest_port '554'
option family 'ipv4'
option proto 'tcp'

config include 'dhcpsnooper'
option type 'script'
option path '/lib/functions/firewall-dhcpsnooper.sh'
option reload '0'

config include 'mmpbx'
option type 'script'
option path '/lib/functions/firewall-mmpbx.sh'
option reload '1'

config include 'dropbear'
option type 'script'
option path '/lib/functions/firewall-dropbear.sh'
option reload '1'

config userredirect 'userredirectA0E4'
option src_dport '2080'
option family 'ipv4'
option dest_ip '0.0.0.0'
option dest_mac 'b8:27:eb:aa:1f:3d'
option dest 'lan'
option enabled '1'
list proto 'tcp'
option name 'RaspMonitor'
option dest_port '80'
option src 'wan'
option target 'DNAT'

config userredirect 'userredirect187B'
option enabled '1'
option dest_mac 'b8:27:eb:b3:08:93'
option src 'wan'
option dest 'lan'
option src_dport '9080'
option dest_ip '0.0.0.0'
option family 'ipv4'
option dest_port '80'
option target 'DNAT'
list proto 'tcp'
option name 'Thermostat'

config userredirect 'userredirect56C2'
option family 'ipv4'
option dest_ip '0.0.0.0'
option dest_mac '00:08:9b:e3:3c:4c'
option target 'DNAT'
option dest_port '51696'
option enabled '1'
list proto 'tcp'
option name 'Transmission'
option src_dport '51696'
option dest 'lan'
option src 'wan'

config userredirect 'userredirect4DD2'
option family 'ipv4'
option dest_mac '00:08:9b:e3:3c:4c'
option enabled '1'
option target 'DNAT'
option src 'wan'
option dest_port '80'
list proto 'tcp'
option name 'NasWeb'
option src_dport '80'
option dest 'lan'

config userredirect 'userredirect99E7'
option src_dport '8080'
option family 'ipv4'
option dest_mac '00:08:9b:e3:3c:4c'
option src 'wan'
option dest 'lan'
option dest_port '8080'
option name 'NasAdmin'
list proto 'tcp'
option target 'DNAT'
option enabled '1'

config zone
        option name 'vpnfirewall'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'nordvpntun'

config forwarding
        option src 'lan'
        option dest 'vpnfirewall'

[fabiobassa]

@ziobabba

Questa é bella mo, le regole e il masquerade sulla VPN ci stanno, il routing é giusto, il router " naviga" e i PC non escono !!!

L Ultima info e poi però ho esaurito le idee 
Ma su un PC mi sai dare il risultato da CMD del comando

tracert -d 8.8.8.8 ( se PC Windows)
traceroute -d 8.8.8.8 ( se PC Linux)
tracert -d 10.7.7.1 ( se PC Windows(
traceroute -d 10.7.7.1 ( se PC linux)
e poi
ping  8.8.8.8
ping 10.7.7.1

Dobbiamo capire dove e perché i pacchetti si fermano

P.S.
Rileggendo meglio , dopo la formattazione eseguita da MisterFtth vedo che comunque l interfaccia tun0 ha fatto 5.7 mega in ingresso e in uscita. Non sono granche ma é segno che l interfaccia naviga.

[ziobabba]

Di seguito le prove che ho fatto tramite un pc windows 7

Codice: [Seleziona]

Microsoft Windows [Versione 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Tutti i diritti riservati.

C:\Users\nemo>tracert -d 8.8.8.8

Traccia instradamento verso 8.8.8.8 su un massimo di 30 punti di passaggio

  1     *        *        *     Richiesta scaduta.
  2     *        *        *     Richiesta scaduta.
  3     *        *     192.168.1.1  rapporti: Protocollo di destinazione non rag
giungibile.

Traccia completata.

C:\Users\nemo>

C:\Users\nemo>tracert -d 10.7.7.1

Traccia instradamento verso 10.7.7.1 su un massimo di 30 punti di passaggio

  1     *       <1 ms     *     192.168.1.1
  2     *        *     192.168.1.1  rapporti: Protocollo di destinazione non rag
giungibile.

Traccia completata.

C:\Users\nemo>

C:\Users\nemo>ping 8.8.8.8

Esecuzione di Ping 8.8.8.8 con 32 byte di dati:
Risposta da 192.168.1.1: Porta di destinazione non raggiungibile.
Richiesta scaduta.
Risposta da 192.168.1.1: Porta di destinazione non raggiungibile.
Risposta da 192.168.1.1: Porta di destinazione non raggiungibile.

Statistiche Ping per 8.8.8.8:
    Pacchetti: Trasmessi = 4, Ricevuti = 3,
    Persi = 1 (25% persi),

C:\Users\nemo>ping 10.7.7.1

Esecuzione di Ping 10.7.7.1 con 32 byte di dati:
Richiesta scaduta.
Risposta da 192.168.1.1: Porta di destinazione non raggiungibile.
Risposta da 192.168.1.1: Porta di destinazione non raggiungibile.
Risposta da 192.168.1.1: Porta di destinazione non raggiungibile.

Statistiche Ping per 10.7.7.1:
    Pacchetti: Trasmessi = 4, Ricevuti = 3,
    Persi = 1 (25% persi),

C:\Users\nemo>
sembra che tutto quello che sta in LAN non riesca a passare dal router anche se come dici tu la tun0 si scambia informazione.
Tenendo sottocontrollo l'interfaccia tun0 appunto, anche se in minima parte, si scambia qualche dato.
A questo punto posso solo pensare che sia qualche configurazione del firewall modem o routing particolare.

[fabiobassa]

perfetto come puoi leggere i pacchetti arrivano dentro il router 192.168.1.1 e lì si piantano a dispetto della tabella di routing del router stesso che vorrebbe che soprattutto la destinazione 10.7.7.1 esca attraverso 10.7.7.77

A questo punto probabilmente manca nella configurazione di nordvpn.conf o il redirect gw def 1 o qualcosa altro

Vuoi fare una prova stupidina ?

Nel PC Windows configura la scheda di rete così:

Codice: [Seleziona]

ip 192.168.1.2
Netmask 255.255.255.0
Gateway 10.7.7.77
e nel firewall aggiungi un masquerade , oltre che sulla lan che già ci sta , anche sul tun0

E un bel forward, oltre che tra lan >>> vpn anche al contrario cioè vpn>>>lan

e vedi se almeno pinghi 10.7.7.1

[ziobabba]

fatto la prova ma niente da fare
effettivamente non so dove sbattere più la testa
Dici che provare a configurarla con luci sia impossibile? ho provato con un raspberry dove avevo montato openwrt ma è risultato una "cambogia"

[fabiobassa]

@ziobabba

Ho esaurito le idee !
Dovrebbe funzionare e non va, vediamo se qualcuno può suggerire altro

[mavelot]

@fabiobassa non è possibile mettere un gateway che non appartiene alla LAN !
ip 192.168.1.2
Netmask 255.255.255.0
Gateway 10.7.7.77

[fabiobassa]

@ziobabba

quanto asserito da @mavelot  è assolutamente vero, sul mio pc ho perennemente impostato due ip sulla lan, per questo mi basta cambiare il gateway, in ogni caso il gateway appartiene alla subnet della lan ,ho detto una cosa non esatta , scusa 

piuttosto hai detto che hai gia provato a modificare il file /etcconfig/firewall cosi?

Codice: [Seleziona]

config forwarding
        option src 'lan'
        option dest 'vpnfirewall'


        config forwarding
        option src 'vpnfirewall'
        option dest 'lan'
ed inoltre

Codice: [Seleziona]

config zone 'lan'
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option mtu_fix '1'
option wan '0'
        option masquerade '1'
cioè aggiungendo un esplicito forwarding anche al contrario e un masquerade sulla lan !!!

inoltre mi sai dire se il comando

Codice: [Seleziona]

cat /proc/sys/net/ipv4/ip_forwardrestituisce il valore 1 oppure 0 ?

[ziobabba]

Allora......
ho trovato questa guida che configura la VPN NORDVPN con LUCI e sembra funzioni anzi va una bomba .... a parte che ora ho il problema sugli androidbox e smarttv per le applicazioni come netflix ma penso che questo sia un altro problema.
http://stitchroads.blogspot.com/2018/08/how-to-setup-nordvpn-openvpn-on.html
configurando passo passo con LUCI ottengo questi dati sul file firewall dove si possino vedere le rati modificate in LAN, WAN e ZONE

Codice: [Seleziona]

config zone 'lan'
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option wan '0'
option network 'lan'
option forward 'DROP'

config zone 'wan'
option name 'wan'
option input 'DROP'
option output 'ACCEPT'
option forward 'DROP'
option conntrack '1'
option wan '1'
option network 'wan wan6 wwan'



config zone
option name 'vpn'
option output 'ACCEPT'
option masq '1'
option mtu_fix '1'
list network 'openvpn'
option forward 'DROP'
option input 'DROP'

config forwarding
option dest 'vpn'
option src 'lan'
Praticamente sembra che droppi il forward sia per la sia LAN che per la WAN e la reindirizzi verso la VPN.
Datemi un vostro parere