OpenWRT - How to set up an OpenVPN Tun Route between two routers - Done with 21.x

Complete guide how to set up an OpenVPN Tun Route between two OpenWRT routers.
Copy + Paste Instructions listed below. Click Show More in description.

opkg update
opkg install luci-app-openvpn openvpn-easy-rsa openvpn-openssl nano tcpdump openvpn

easyrsa init-pki
easyrsa build-ca nopass
easyrsa build-server-full Server_SiteA nopass
easyrsa build-client-full Client_SiteB_SiteA nopass
easyrsa gen-dh

OpenVPN Server Config

config openvpn 'VPN_Tun_Server'
option cipher 'AES-256-GCM'
option client_config_dir '/etc/openvpn/ccd'
option client_to_client '1'
option comp_lzo 'no'
option dev 'tun0'
option keepalive '10 60'
option mssfix '1420'
option mode 'server'
option persist_key '1'
option persist_tun '1'
option port '7500'
option proto 'udp'
option remote_cert_tls 'client'
option reneg_sec '0'
option route '192.168.3.0 255.255.255.0'
option server '10.20.0.0 255.255.255.0'
option topology 'subnet'
option verb '3'
option enabled '1'

OpenVPN Client Config

config openvpn 'VPN_Tun_Client'
option auth_nocache '1'
option cipher 'AES-256-GCM'
option client '1'
option comp_lzo 'no'
option connect_retry '5 60'
option dev 'tun0'
option nobind '1'
option persist_key '1'
option persist_tun '1'
option port '7500'
option proto 'udp'
option remote_cert_tls 'server'
option reneg_sec '0'
option verb '3'
option enabled '1'

Problems?
* Restart both routers and clients.
* Test temporarily disabling Windows Firewall to ensure this is not blocking ping.
* Ensure the file in CCD directory matches OpenVPN Client common name e.g Client_SiteB_SiteA
* Ensure OpenVPN config has the correct remote server address / IP.routers.

[sunraygroup]

Hello! I have Turris (openwrt fork) router at home (lets say R1), which is server and openwrt router at office (lets say R2), vpn server and clients works ok, I can connect from my mac to R1 lan and hosts on it normally, but we tried to do site-to-site configuration and only what we could achieve, is connecting from R1 terminal to R2 lan, but not vice-versa and not either from R1 lan host to R2 lan host and vice-versa. Is there some possibility you could make some support? Thanks in advance! (I tried everything, routing, manual routing, packet tracing, firewall disabling, nothing helped...)

[tedballou]

Can you set this up for just LAN traffic on server side and not internet?

[vanadium]

can you make a tutorial how to setupa a openvpn server to connect to home network from other networks? b.r.

[baffomorettiilcustodedisto]

Very good, it’s possible bypass my nat of 4g connection ? I would ip public on my nat 4g