option server '10.8.0.0 255.255.0.0' 

config openvpn 'myvpn'

    option enabled '1'
    option dev 'tun'
    option port '1194'
    option proto 'udp'
#specify to use compression
    option comp_lzo 'yes'
#logging
    option status '/var/log/openvpn_status.log'
    option log '/tmp/openvpn.log'
    option verb '3'
    option mute '5'
#ping every 10 seconds, assume not responding after 120 seconds
    option keepalive '10 120'
#keep key and tunnel persistent across restarts
    option persist_key '1'
    option persist_tun '1'
#set user and group to less-privileged account (UNIX/Linux only)
    option user 'nobody'
    option group 'nogroup'
#certificate information
    option ca '/etc/easy-rsa/keys/ca.crt'
    option cert '/etc/easy-rsa/keys/c7.crt'
    option key '/etc/easy-rsa/keys/c7.key'
    option dh '/etc/easy-rsa/keys/dh2048.pem'
#server settings
    option mode 'server'
    option tls_server '1'
    option server '10.8.0.0 255.255.0.0'
#specify topology to use
    option topology 'subnet'
#specify gateway to use
    option route_gateway 'dhcp'
#allow clients to "see" one another
    option client_to_client '1'
#options to push to clients
    list push 'comp-lzo yes'
#keep key and tunnel persistent across restarts
    list push 'persist-key'
    list push 'persist-tun'
#set user and group to less-privileged account (UNIX/Linux only)
    list push 'user nobody'
    list push 'user nogroup'
#specify topology to use
    list push 'topology subnet'
#specify gateway to use
    list push 'route-gateway dhcp'
#redirect ALL traffic through the VPN server (this is IMPORTANT if you don't trust your local network)
#    list push 'redirect-gateway def1'
#  push a local route to your clients (allow your clients to access the server's network)
    list push 'route 10.0.0.0 255.255.0.0'
    
#push DNS to your clients (this is IMPORTANT if you don't trust your local network)
#  list push 'dhcp-option DNS 208.67.222.222'
#  list push 'dhcp-option DNS 208.67.220.220'

config rule
    option name 'Allow-OpenVPN-Inbound'
    option target 'ACCEPT'
    option src 'wan'
    option proto 'udp'
    option dest_port '1194'

config zone
    option name 'vpn'
    option input 'ACCEPT'
    option forward 'ACCEPT'
    option output 'ACCEPT'
    option masq '1'
    option network 'vpn0'

config forwarding
    option src 'vpn'
    option dest 'wan'

config forwarding
    option src 'vpn'
    option dest 'lan'