How to connect new user to hotspot while vpn running?

Normally in plain hotspot mode (without VPN setup), clients will get
an IP address from the phone's DHCP server.

However, when the OpenVPN client is running, by default it is
redirecting all traffic to the OpenVPN server, meaning any client
traffic is also being redirected. Hence, the clients aren't talking to
the phone's DHCP server any more - they are talking to the OpenVPN
server, and if that doesn't provide an IP address via DCHP then the
clients connection attempts will "hang".

There are possible workaround to keep tethering functionality on other connecting clients:

1. Using postrouting and forwarding rules

You can just add just post-routing and forwarding rules i.e

iptables -t filter -F FORWARD

iptables -t nat -F POSTROUTING

iptables -t filter -A FORWARD -j ACCEPT

iptables -t nat -A POSTROUTING -j MASQUERADE

(this is the solution I'm using currently),

2. Setup IP addresses manually

   
   
   
   
   
   • You may need to assign other clients IP manually (static IP
     address) to bypass DCHP server.
   
   

3. Exclude hotspot subnet from tunnel

• The fix is to identify the subnet used by the hotspot service and
  manually add it to Excluded Networks for the connection. i.e
  192.168.43.0/24.




• Now when the tunnel is initiated the hotspot subnet is always excluded from routing through the tunnel regardless of startup
  sequence and tethering always works.

or simply excluding 192.168.43.0/24 (and including 0.0.0.0/0) rules from iptables.

Acknowledgements

• Wi-Fi hotspot enabled on host device with OpenVPN connected... connected client devices have no internet