Use sexpect to initiate OpenVPN connection which uses DUO mobile from router.

expect-openvpn.sh

#!/bin/sh

if ! which sexpect >& /dev/null; then
    echo "sexpect not found in your \$PATH"
    exit 1
fi

export SEXPECT_SOCKFILE=/tmp/sexpect-openvpn-aa0.sock
sexpect spawn openvpn --config /root/client.ovpn

  sexpect expect -re 'Enter Auth Password:'
  sexpect send -enter `cat /root/password2.txt`
  sexpect expect -re '^.*CRV1:R,E:([A-Za-z0-9+/=]+).*$'
  out=`sexpect expect_out -index 1`
  sexpect expect -re 'Enter Auth Password:'
  sexpect send -enter CRV1::$out::push
  sexpect interact

sexpect

Sexpect binary tests successfully on OpenWRT on a TP-LINK Archer C7.