The first two are covered by the rule with the tun+ interface in the FORWARD chain. AFAIK, the last one changes the behaviour of the incomng traffic so it gets NAT'd to the ClearOS LAN IP so all traffic appears local to the LAN. This will/may get round a Windows firewalling issue where the Windows firewall often blocks traffic not originating from its own LAN so avoids changing firewall rules to any LAN attached machines which are required to be accessed via OpenVPN, but you'd need to check the Windows firewalls. It is generally unnecessary. I don't use it. I just use the default rules.

You may want to look at changing:

push "redirect-gateway def1"

to

push "redirect-gateway def1 bypass-dhcp"

This is to avoid a possible issue when the client tries to renew its local DHCP lease.

There are ways of making the connection more stable and resilient to an interface outage. In the ovpn file you can have multiple "remote" lines, one for each WAN, so the OpenVPN client will keep trying both until a connection is made. Also add a line "float" to the ovpn file. This will allow the client to automatically receive a packet from either interface once a connection is negotiated.

In /etc/openvpn/clients.conf, check you have the line "multihome".

I personally would leave udp:1194 open on both interfaces and remove the destination port as it should make switching more automatic, but you may want to test it.