I have a Raspberry Pi (192.168.1.69 - pi local IP address, static) running Raspbian (debian linux) behind my Verizon ActionTec Router (192.168.1.1 - gateway).
It is running a VNC server (tightvncserver).
The Pi can be accessed by ssh to the Public IP of the router which forwards port 22 to the Pi.
To access the VNC server I use
ssh pi@X.X.X.X -L 5901:localhost:5901
where X.X.X.X is the Public IP address of the Verizon ActionTec Router
This takes the 5901 of my connecting device (my laptop) and I believe forwards it to the Raspberry Pi.
I can then use the command:
to connect via the VNC Viewer program on my laptop to view the Raspberry Pi via VNC.
I am using the NetworkManger program on the Raspberry Pi to connect to my home network.
Here comes the tricky part:
I want to use the Raspberry Pi on a VPN. I have verified and connected it successfully to the VPN using NetworkManager. The VPN uses the OpenVPN VPN protocol. The Raspberry now acquires an IP address of Y.Y.Y.Y
Obviously, when I connect the Raspberry to the VPN I can no longer access it remotely because all of its ports are forwarded through the VPN.
- The question is, how do I exclude ports from the VPN client (preferably) or network? so that I would still be able to remotely access it? Specifically, I want to access port 22 (ssh), 5901 (VNC), 21(ftp), and maybe even 80(http).
I know the point of a VPN client is to take all of your connections and tunnel them through to the destination VPN server so everything is encrypted by the destination, but for remote purposes like VNC I want to exclude some of those ports.
I found this method on another site that was being used with a tomato firmware router letting every port other than 119 go through the VPN tunnel:
ip route add default table 100 via [Your ISP's Gateway] ip rule add fwmark 1 table 100 ip route flush cache iptables -t mangle -I PREROUTING -p tcp --dport 119 -j MARK --set-mark 1
- Could this iptables method be applied directly to the Raspberry Pi or is it just a method for a router?
I would think that there must be a way to exclude one port from being forwarded through the VPN on the Debian OS level.
The VPN creates a tun0 interface. The
Doing other further research I found commands which can be used to ONLY send port 80 and 443 through the VPN (opposite of what I want):
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j DROP -A INPUT -i eth0 -p tcp -m tcp --dport 443 -j DROP -A INPUT -i tun0 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -i tun0 -p tcp -m tcp --dport 443 -j ACCEPT
Also, there is a "routes" checkbox in the NetworkManager gui when editing the VPN connection. If you open it, it is titled "Editing IPv4 routes for VPN. You can add, it has columns for: Address, Netmask, Gateway, Metric.
Underneath the the add section there are two checkboxes:
_Ignore Automatically obtained routes _Use this connection only for resources on its network
Not sure what I can use the "routes" configuration/options for.
Any help would be appreciated.