Need help bypassing cgnat with openvpn

[ioneng]

I'm using a 4G modem for my home internet connection. It doesn't have a public ip address. So I can't acces my Raspberry Pi from outside. My AC68U is connected to this modem and is in router mode with a private IP assigned by the modem because somehow bridge mode makes the modem unstable. This is probably irrelevant to the issue below.

I set up a openvpn server on an external vps. AC68U connects to it as a client and my whole LAN can connect to the internet through the vpn server just fine.

I asked my friend to connect his PC to my VPN server at his house and ran a http server on the PC. He did not need to set up port forwarding to get this working because his PC is the VPN client. I can connect to it no problem from my mobile phone over mobile data. So the VPN server and its iptables setting are ok.

I also connected my mobile phone directly to the modem's wifi AP and opened up the web page on raspberry pi using the external IP of AC68U without problem. That's an indication that port forwarding is working.

What's not working is port forwarding over the VPN connection. I tried turn on/off firewall on AC68U with no change in effect.

I'm no network expert so I'm pasting my VPN settings and iptables here hoping someone can give me some directions. The masked fields in the two screenshots are public IP address of the VPN server. 192.168.1.4 is the external IP of AC68U, which is assigned by the modem. 192.168.2.1 is the internal IP of AC68U. I'm trying to redirect port 11161 to port 80 on the Pi with IP 192.168.2.39.

tzadmin@RT-AC68U-4808:/tmp/home/root# iptables -L -vnt nat
Chain PREROUTING (policy ACCEPT 4964 packets, 496K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 VSERVER    all  --  *      *       0.0.0.0/0            192.168.1.4

Chain INPUT (policy ACCEPT 2863 packets, 209K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 1009 packets, 83269 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 1009 packets, 83269 bytes)
 pkts bytes target     prot opt in     out     source               destination
 2033  284K MASQUERADE  all  --  *      tun11   192.168.2.0/24       0.0.0.0/0
  203 12112 PUPNP      all  --  *      eth3    0.0.0.0/0            0.0.0.0/0
   68  3608 MASQUERADE  all  --  *      eth3   !192.168.1.4          0.0.0.0/0
    0     0 MASQUERADE  all  --  *      br0     192.168.2.0/24       192.168.2.0/24

Chain DNSFILTER (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain DNSVPN1 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain LOCALSRV (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain PCREDIRECT (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain PUPNP (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain VSERVER (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:11161 to:192.168.2.39:80
    0     0 VUPNP      all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain VUPNP (1 references)
 pkts bytes target     prot opt in     out     source               destination
tzadmin@RT-AC68U-4808:/tmp/home/root#