DIR-320 + GPRS/3G/CDMA + Yota = ?

[phobos]

ÒÎâàðèùè!
Ñòîëêíóëñÿ ñ ïðîáëåìîé, ÷òî íà íàñòðîåíîì wl500gp v2 + Yota èíòåðíåò ðàçäàåòñÿ âñåì êëèåíòàì áåç ïðîáëåì, à âîò ïðè ïîäíÿòèè VPN òóíåëÿ, ïàêåòû ñ ðîóòåðà äîõîäÿò äî óäàëåííîé ñåòè, à ñ êëèåíòîâ - íåò.
Ïðîøèâêà 1.9.2.7-10.7 íà îáîèõ ðîóòåðàõ.
Êàðòà ñåòè:

ñåòü 192.168.1.40/29---wl500gpv2(client) + Yota---internet---wl500gpv2(server) + Ethernet---ñåòü 192.168.0.0/24

Íóæíî êîìïó 192.168.1.42 ïîëó÷èòü äîñòóï ê êîìïó 192.168.0.13

Êîíôèã ñåðâåðà

dev tun0
tls-server
server 192.168.255.0 255.255.255.0
ifconfig 192.168.255.1 192.168.255.2
client-config-dir ccd
route 192.168.255.0 255.255.255.0 #IP Range of VPN
route 192.168.1.0 255.255.255.240 #IP Range 1
route 192.168.1.16 255.255.255.248 #IP Range 2
route 192.168.1.24 255.255.255.248 #IP Range 3
route 192.168.1.32 255.255.255.248 #IP Range 4
route 192.168.1.40 255.255.255.248 #IP Range 5
#Say to clients that Office has 192.168.0.0/24 LAN
push "route 192.168.0.0 255.255.255.0"
#keys
dh /opt/etc/openvpn/keys/dh1024.pem
ca /opt/etc/openvpn/keys/ca.crt
cert /opt/etc/openvpn/keys/office.crt
key /opt/etc/openvpn/keys/office.key
client-to-client
port 1194
proto udp
user nobody
group nobody
comp-lzo
persist-tun
persist-key
verb 5
log-append /opt/var/log/openvpn/openvpn.log
status /opt/var/log/openvpn/status.log
keepalive 10 60

Êîíôèã ïðîáëåìíîãî 5 êëèåíòà (îñòàëüíûå ñèäÿò ÷åðåç Ethernet è ó íèõ âñå ðàáîòàåò ïðàâèëüíî ñ òàêèìè æå êîíôèãàìè)

dev tun
client
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
#Sertificate
pkcs12 /opt/etc/openvpn/keys/5.p12
comp-lzo
verb 3
log-append /opt/var/log/openvpn/5.log
status /opt/var/log/openvpn/status.log

Íàñòðîéêè IPtables íà êëèåíòå

 iptables -n -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       udp  --  0.0.0.0/0            0.0.0.0/0          udp dpt:1194 to:192.168.1.41:1194                                                                                                                             

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  192.168.1.40/29      192.168.1.40/29
MASQUERADE  all  -- !10.129.22.45         0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain VSERVER (0 references)
target     prot opt source               destination

Ïðàâèëà èç post-firewall

iptables -D INPUT -j DROP
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -I PREROUTING -i wimax0 -p udp --dport 1194 -j DNAT --to-destination $4:1194
iptables -A INPUT -j DROP
iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I FORWARD -o tun0 -j ACCEPT
iptables -I OUTPUT -o tun0 -j ACCEPT

 ÷åì ìîæåò áûòü çàãâîçäêà?