How to correctly configure pptp on OpenWrt?

Question

linux

Hello, I can’t correctly configure pptp on OpenWrt Chaos Calmer 15.05.1, TP-Link TL-WR841N / ND v9 router.
Rather, it works, but in unsafe mode, so to speak, only when Input prntscr.com/dlxdxp is allowed, as soon as I turn it off, the Internet stops working. Maybe something with the firewall settings?
firewall.config

config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option network 'lan'
option forward 'REJECT'

config zone
option name 'wan'
option output 'ACCEPT'
option mtu_fix '1'
option masq '1'
option forward 'ACCEPT'
option network 'FlyNet wan'
option input 'ACCEPT'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config include
option path '/etc/firewall.user'

config rule
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config redirect
option target 'DNAT'
option src 'wan'
option dest 'lan'
option proto 'tcp udp'
option src_dport '50001'
option dest_ip '192.168.1.102'
option dest_port '50001'
option name 'FlylinkDC-1-PC'

config redirect
option target 'DNAT'
option src 'wan'
option dest 'lan'
option proto 'tcp udp'
option src_dport '50002'
option dest_ip '192.168.1.191'
option dest_port '50002'
option name 'FlylinkDC-2-PC'

config rule
option target 'ACCEPT'
option dest 'wan'
option name 'pptp'
option proto 'tcp'
option src_port '1723'
option src 'wan'

config rule
option enabled '1'
option target 'ACCEPT'
option name 'multicast'
option proto 'all'
option src 'wan'
option dest_ip '224.0.0.0/4'

config forwarding
option dest 'wan'
option src 'lan'

network.config

config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd63:f379:aa0f::/48'

config interface 'lan'
option ifname 'eth0'
option force_link '1'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
option macaddr '30:**:**:**:**15'

config interface 'wan'
option reqopts 'staticroutes'
option ifname 'eth1'
option proto 'dhcp'
option macaddr '30:**:**:**:**15'

config interface 'wan6'
option ifname 'eth1'
option proto 'dhcpv6'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 4'

config interface 'FlyNet'
option proto 'pptp'
option server 'vpn.flynet.by'
option username 'username'
option password 'password'
option mtu '1420'

Answer 1

All figured out. Checked all required packages from official documentation https://wiki.openwrt.org/doc/howto/vpn.client.pptp. The kmod-nf-nathelper-extra package was missing.