GL-AR750s openVPN iroute client config

Technical Support for Routers VPN, DNS, Leaks
1

I am trying to configure ovpn to use route/iroute to enable server side route to the client subnet on specific client connections. I used it a lot in the stock openWRT routers. I see that GL-inet ovpn configuration is non standard and uses /etc/config/vpn_service and /etc/openvpn/ovpn/server.ovpn to configure the ovpn service. These server.ovpn file is overwritten with hardcoded configuration every time you start the service in the router GUI Admin panel. You can try to change the configuration of server.ovpn and your changes are gone at stop/start.
The standard ovpn configuration in /etc/config/openvpn is ignored and standard service defined in /etc/init.d/openvpn is not in use.
I used gl-inet CA to create new client certificates with unique CNs so the client configuration selection is possible. One of the conditions for this configuration to work is not to use duplicate-cn. Unfortunately it is defined in the server.ovpn that is overwritten or enforced.
The process for using route/iroute is described here: How To Guide: Set Up & Configure OpenVPN Client/server VPN | OpenVPN
My configuration that does not work is here - main reason most likely is the duplicate-cn that is enforced in server.ovpn:

root@pzi-central-1-rt:/etc/config$ cat vpn_service

config general 'global'
option access 'ACCEPT'
option ovpn '/etc/openvpn/ovpn/server.ovpn'
option enable '1'

config service 'vpn'
option auth 'SHA256'
option proto 'udp'
option port '1194'
option cipher 'AES-256-GCM'
option comp 'adaptive'
option subnetv6 'fd00:db8:0:123::0'
option mask '255.255.255.0'
option start '2'
option end '100'
option host '74.66.8.202'
option subnet '10.8.222.0'
option dev 'tun-SERVER'
option dev_type 'tun'
option client_config_dir '/etc/openvpn/ccd'
list route '192.168.220.0 255.255.255.0'
list push 'route 192.168.222.0 255.255.255.0'
list push 'dhcp-option DNS 192.168.222.1'
list push 'dhcp-option DOMAIN foo.net'

root@pzi-central-1-rt:/etc/openvpn/ccd$ cat pzi-central-2
iroute 192.168.220.0 255.255.255.0

2

The firmware that GL iNet ships is great if you want to use it as a travel router, and stay within the bounds of what they provide. Anytime I try to do something outside of that, I find it painful, and often, even if I get it to work, it breaks on a future upgrade of the stock GL iNet firmware. GL iNet seems to assume that they are free to overwrite any manually made configuration.

For my special cases, I end up putting generic OpenWrt on my GL iNet routers, and not using the GL iNet firmware. The good news is the AR750s is well supported by generic OpenWrt.

3

Eric - thank you very much. I thought this is my option B. Thanks for confirming the support for generic OpenWRT!