Internal OpenVPN server route problem

[fatice]

Hi Guys

I have a small problem on my AC68U running Merlin 384.7_2, running behind another router.

- The Internet router is given by the ISP with VDSL, address 192.168.20.1
- AC68U is in router mode with address 192.168.20.2, but the WAN port is not connected with DHCP server disabled. All clients are connected via WiFi or LAN.

- After ssh into the AC68U, noticing that there is no default gateway and wrong DNS server (in router mode, it might be pointing to itself).
------added a default gateway pointing to 192.168.20.1
------added 1.1.1.1 to /etc/resolv.conf (recreate symlink)
With the above setup, the route is able to time sync and wget packages.

If the OpenVPN server is setup with TAP mode, everything works as if the external client is within the network. But if the AC68U OpenVPN server is setup in TUN mode, the client obtained an IP address: 10.8.0.2, but it cannot route to anywhere.

Here is the resulting routing table

Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.0 * 255.255.255.0 U 0 0 0 tun21
192.168.20.0 * 255.255.255.0 U 0 0 0 br0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default 192.168.20.1 0.0.0.0 UG 0 0 0 br0

These are the parameters OpenVPN server:

Interface Type: TUN
Protocol: UDP
Server Port: 1194
Authorization Mode: TLS
TLS control channel security: disabled
HMAC Authentication: disabled
VPN Subnet / Netmask 10.8.0.0 255.255.255.0
Advertise DNS to clients Yes

May I know what did I do wrong or what am I missing?

Thanks