So here is what it looks like to me:
VPN ON (Forwarding stops working)
71.72.120.1 * 255.255.255.255 0 vlan2 (WAN)
10.149.112.1 10.149.112.5 255.255.255.255 0 tun11
68.68.17.21 71.72.120.1 255.255.255.255 0 vlan2 (WAN)
10.149.112.5 * 255.255.255.255 0 tun11
192.168.1.0 * 255.255.255.0 0 br0 (LAN)
71.72.120.0 * 255.255.248.0 0 vlan2 (WAN)
127.0.0.0 * 255.0.0.0 0 lo
default 10.149.112.5 128.0.0.0 0 tun11
128.0.0.0 10.149.112.5 128.0.0.0 0 tun11
default 71.72.120.1 0.0.0.0 0 vlan2 (WAN)
VPN OFF (forwarding works)
71.72.120.1 * 255.255.255.255 0 vlan2 (WAN)
192.168.1.0 * 255.255.255.0 0 br0 (LAN)
71.72.120.0 * 255.255.248.0 0 vlan2 (WAN)
127.0.0.0 * 255.0.0.0 0 lo
default 71.72.120.1 0.0.0.0 0 vlan2 (WAN)
Here is the iptables dumps
VPN ON (Forwarding not working)
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
27 2990 ACCEPT all — tun11 * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all — * * 0.0.0.0/0 0.0.0.0/0 state INVALID
8025 983K ACCEPT all — * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 shlimit tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEW
1 140 ACCEPT all — lo * 0.0.0.0/0 0.0.0.0/0
191 13874 ACCEPT all — br0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT udp — * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
7483 378K ACCEPT all — tun11 * 0.0.0.0/0 0.0.0.0/0
14319 18M all — * * 0.0.0.0/0 0.0.0.0/0 account: network/netmask: 192.168.1.0/255.255.255.0 name: lan
0 0 ACCEPT all — br0 br0 0.0.0.0/0 0.0.0.0/0
9 360 DROP all — * * 0.0.0.0/0 0.0.0.0/0 state INVALID
249 12232 TCPMSS tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
14001 18M ACCEPT all — * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 wanin all — vlan2 * 0.0.0.0/0 0.0.0.0/0
0 0 wanout all — * vlan2 0.0.0.0/0 0.0.0.0/0
309 15543 ACCEPT all — br0 * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 15178 packets, 19M bytes)
pkts bytes target prot opt in out source destination
Chain shlimit (1 references)
pkts bytes target prot opt in out source destination
0 0 all — * * 0.0.0.0/0 0.0.0.0/0 recent: SET name: shlimit side: source
0 0 DROP all — * * 0.0.0.0/0 0.0.0.0/0 recent: UPDATE seconds: 60 hit_count: 4 name: shlimit side: source
Chain wanin (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.100 tcp dpt:22
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.100 tcp dpt:25
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.100 tcp dpt:80
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.100 tcp dpt:443
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.130 tcp dpt:45631
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.130 tcp dpt:1550
0 0 ACCEPT udp — * * 0.0.0.0/0 192.168.1.130 udp dpts:1550:1556
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.130 tcp dpts:6783:6785
0 0 ACCEPT udp — * * 0.0.0.0/0 192.168.1.130 udp dpts:6783:6785
Chain wanout (1 references)
pkts bytes target prot opt in out source destination
Chain PREROUTING (policy ACCEPT 430 packets, 34731 bytes)
pkts bytes target prot opt in out source destination
26 1308 WANPREROUTING all — * * 0.0.0.0/0 71.72.125.234
0 0 DROP all — vlan2 * 0.0.0.0/0 192.168.1.0/24
Chain POSTROUTING (policy ACCEPT 71 packets, 4945 bytes)
pkts bytes target prot opt in out source destination
225 11263 MASQUERADE all — * tun11 192.168.1.0/24 0.0.0.0/0
0 0 MASQUERADE all — * vlan2 0.0.0.0/0 0.0.0.0/0
1 340 SNAT all — * br0 192.168.1.0/24 192.168.1.0/24 to:192.168.1.1
Chain OUTPUT (policy ACCEPT 72 packets, 5285 bytes)
pkts bytes target prot opt in out source destination
Chain WANPREROUTING (1 references)
pkts bytes target prot opt in out source destination
0 0 DNAT icmp — * * 0.0.0.0/0 0.0.0.0/0 to:192.168.1.1
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 to:192.168.1.100
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 to:192.168.1.100
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.1.100
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:192.168.1.100
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:45631 to:192.168.1.130
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1550 to:192.168.1.130
0 0 DNAT udp — * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1550:1556 to:192.168.1.130
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:6783:6785 to:192.168.1.130
0 0 DNAT udp — * * 0.0.0.0/0 0.0.0.0/0 udp dpts:6783:6785 to:192.168.1.130
Chain PREROUTING (policy ACCEPT 30135 packets, 19M bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 8249 packets, 1001K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 21808 packets, 18M bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 15208 packets, 19M bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 37007 packets, 38M bytes)
pkts bytes target prot opt in out source destination
VPN OFF (Forwarding does work)
Chain INPUT (policy DROP 34 packets, 1728 bytes)
pkts bytes target prot opt in out source destination
1 40 DROP all — * * 0.0.0.0/0 0.0.0.0/0 state INVALID
8898 1117K ACCEPT all — * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 shlimit tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEW
1 140 ACCEPT all — lo * 0.0.0.0/0 0.0.0.0/0
348 25898 ACCEPT all — br0 * 0.0.0.0/0 0.0.0.0/0
52 17782 ACCEPT udp — * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
31330 34M all — * * 0.0.0.0/0 0.0.0.0/0 account: network/netmask: 192.168.1.0/255.255.255.0 name: lan
0 0 ACCEPT all — br0 br0 0.0.0.0/0 0.0.0.0/0
23 1570 DROP all — * * 0.0.0.0/0 0.0.0.0/0 state INVALID
436 21692 TCPMSS tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
30785 34M ACCEPT all — * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
1 60 wanin all — vlan2 * 0.0.0.0/0 0.0.0.0/0
207 21155 wanout all — * vlan2 0.0.0.0/0 0.0.0.0/0
521 36967 ACCEPT all — br0 * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 706 packets, 579K bytes)
pkts bytes target prot opt in out source destination
Chain shlimit (1 references)
pkts bytes target prot opt in out source destination
0 0 all — * * 0.0.0.0/0 0.0.0.0/0 recent: SET name: shlimit side: source
0 0 DROP all — * * 0.0.0.0/0 0.0.0.0/0 recent: UPDATE seconds: 60 hit_count: 4 name: shlimit side: source
Chain wanin (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.100 tcp dpt:22
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.100 tcp dpt:25
1 60 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.100 tcp dpt:80
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.100 tcp dpt:443
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.130 tcp dpt:45631
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.130 tcp dpt:1550
0 0 ACCEPT udp — * * 0.0.0.0/0 192.168.1.130 udp dpts:1550:1556
0 0 ACCEPT tcp — * * 0.0.0.0/0 192.168.1.130 tcp dpts:6783:6785
0 0 ACCEPT udp — * * 0.0.0.0/0 192.168.1.130 udp dpts:6783:6785
Chain wanout (1 references)
pkts bytes target prot opt in out source destination
Chain PREROUTING (policy ACCEPT 230 packets, 17996 bytes)
pkts bytes target prot opt in out source destination
88 4468 WANPREROUTING all — * * 0.0.0.0/0 71.72.125.234
0 0 DROP all — vlan2 * 0.0.0.0/0 192.168.1.0/24
Chain POSTROUTING (policy ACCEPT 1 packets, 60 bytes)
pkts bytes target prot opt in out source destination
125 9484 MASQUERADE all — * vlan2 0.0.0.0/0 0.0.0.0/0
1 340 SNAT all — * br0 192.168.1.0/24 192.168.1.0/24 to:192.168.1.1
Chain OUTPUT (policy ACCEPT 32 packets, 2147 bytes)
pkts bytes target prot opt in out source destination
Chain WANPREROUTING (1 references)
pkts bytes target prot opt in out source destination
0 0 DNAT icmp — * * 0.0.0.0/0 0.0.0.0/0 to:192.168.1.1
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 to:192.168.1.100
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 to:192.168.1.100
1 60 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.1.100
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:192.168.1.100
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:45631 to:192.168.1.130
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1550 to:192.168.1.130
0 0 DNAT udp — * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1550:1556 to:192.168.1.130
0 0 DNAT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:6783:6785 to:192.168.1.130
0 0 DNAT udp — * * 0.0.0.0/0 0.0.0.0/0 udp dpts:6783:6785 to:192.168.1.130
Chain PREROUTING (policy ACCEPT 48670 packets, 36M bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 9373 packets, 1167K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 39161 packets, 34M bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 16960 packets, 21M bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 56098 packets, 56M bytes)
pkts bytes target prot opt in out source destination
As always, Thanks.. if you see anything and can give some thoughts, I'm always appreciative!