Acess point with ip_forward causes problem to the ethernet

Try this in /storage/.config/autostart.sh (I use it to connect the zerotier interface with the ethernet interface), it works very well for me.

You will have to find out the name of your hotspot interface (use the ifconfig command) and substitute it in <interface>. If eth0 has another name, change it too.

# bridge <interface> >>> eth0
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i <interface> -o eth0 -j ACCEPT

I understand your complaint but you do not provide any information to diagnose the problem. The analysis of ifconfig and route SSH commands can help you find the solution to your problem. Everything works fine for me and when a target (special IP address) is not reachable I add routing rules (route command), everything is very easy. Remember that forwarding and routing rules remain active until the next reboot. If you write two contradictory rules in the same session, it will never work.

I have not seen sensitive information. You have a lot of interfaces which is normal when docker is installed. That there is more than one gateway is also normal but there will only be one gateway that has an Internet connection, it will be the router.

If you want to establish a route to the internet for unresolved IP addresses you can write:

route add -net 0.0.0.0 netmask 0.0.0.0 gw <router-ip>

Another thing: The interfaces of a device (which can be many) do not see each other, to do this you have to establish forwarding rules (iptables commands). If you want the rules to be absolutely bidirectional you have to remove "iptables -A FORWARD -m conntrack --ctstate RELATED, ESTABLISHED -j ACCEPT" and put instead "iptables -A FORWARD -i eth0 -o <interface> -j ACCEPT ".

If you have problems with docker services, they can be solved very easily by adding the parameter "--net=host" during the creation of the container, in this case the listening ports of the service can interfere with those of LE.

More examples:

Suppose device 192.168.10.12 wants to access device 192.168.20.45. Both domains 192.168.10.0/24 and 192.168.20.0/24 join in a third device with two interfaces and addresses 192.168.10.88 and 192.168.20.98.

In the device 192.168.10.12, a routing rule must be established "route add -net 192.168.20.0 netmask 255.255.255.0 gw 192.168.10.88". And in the device 192.168.10.88 and 192.168.20.98 we will have to establish forwarding rules to create a bridge between domains.

Your device has the address 192.168.0.194 on the eth0 interface whose domain matches the router.

Your device also has the address 192.168.1.1 on the tether interface.

Your device knows that the exit route to the internet is 192.168.0.1 because the router told it through dhcp or you told it with the manual address assignment.

For a device 192.168.1.2 in the 192.168.1.0/24 domain to know how to go to the internet, it will be necessary to establish a route to 192.168.1.1. This is done by manually setting the tether connection parameters (gateway = 192.168.1.1) for the device 192.168.1.2. But this is not enough because it is also necessary to bridge 192.168.1.1. For example like this in the 192.168.1.1 device:

# bridge tether <-> eth0

echo 1 > /proc/sys/net/ipv4/ip_forward

echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -A FORWARD -i eth0 -o tether -j ACCEPT

iptables -A FORWARD -i tether -o eth0 -j ACCEPT

I do not understand what the problem is. My question is where do you install the VPN client? If you are installing it on a tether client, for example 192.168.1.2, there should be no problem and you should follow the instructions above. Otherwise, you must repeat the previous steps with the VPN service installed and do an analysis again.

There is no reason for your VPN provider to block the connection unless it counts the number of connected devices. The provider has no means of knowing if you are using tether or not, it can only count the number of connected devices with the same public IP address.