Q:

OpenVPN + iptables: not forwarding traffic

I am trying to forward traffic through a vpn with openvpn on a vps. I already did this successfully on an OpenVZ virtualized server in the past, but I cannot replicate the working behaviour on a new installation on a different vps. I changed provider because of reasons unimportant to this question's scope.
I can correctly connect to the vpn with my windows client, but I reach pages through my machine's public IP instead of the vps public IP.
The vps runs debian 7, 32bit. Server openvpn config:
port 1194
proto udp
dev tun

ca      /etc/openvpn/easy-rsa/keys/ca.crt    # generated keys
cert    /etc/openvpn/easy-rsa/keys/server.crt
key     /etc/openvpn/easy-rsa/keys/server.key  # keep secret
dh      /etc/openvpn/easy-rsa/keys/dh1024.pem

server 10.9.8.0 255.255.255.0  # internal tun0 connection IP
ifconfig-pool-persist ipp.txt

keepalive 10 120

comp-lzo         # Compression - must be turned on at both end
persist-key
persist-tun

push "redirect-gateway"

status log/openvpn-status.log

verb 3  # verbose mode
client-to-client

Client (Windows 7) openvpn config:
client

dev tun

proto udp

remote my-server-ip 1194

remote-random

resolv-retry infinite

nobind

persist-key
persist-tun

mute-replay-warnings

ca   "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\nick.crt"
key  "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\nick.key"

comp-lzo

verb 3

keepalive 10 120

route-method exe
route-delay 2

ifconfig:
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.8.1  P-t-P:10.9.8.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:127.0.0.2  P-t-P:127.0.0.2  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: .../128 Scope:Global
          inet6 addr: .../128 Scope:Global
          inet6 addr: .../128 Scope:Global
          inet6 addr: .../128 Scope:Global
          inet6 addr: .../128 Scope:Global
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:15332 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7317 errors:0 dropped:56 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:13666157 (13.0 MiB)  TX bytes:762502 (744.6 KiB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:my-server-ip  P-t-P:my-server-ip  Bcast:my-server-ip  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

iptables -L: (rules with port 20100 are from previous experiments that have nothing to do with this)
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:20100
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:20100
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:20100
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  10.9.8.0/24          anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination       

iptables -L -t nat:
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       all  --  anywhere             anywhere             to:my-server-ip

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination     

I already checked most discussions, forums and blog posts about this error, but couldn' quite understand what's wrong with my config.
Btw, ip_forward is 1, also in sysctl.conf.

A:

I solved the issue by restarting the vps and re-entering all the iptables rules.

