I use a dynamic DNS service which is sent ip address updates from my router. In router settings, ports 22 and 80 are forwarded to my server at 192.168.1.10. I have a webserver and sshd running on my server. From outside my local network, I can go to mydomain.dyndns.org, or ssh into my server. This works fine until I connect to OpenVPN. When I connect my server to my OpenVPN provider, I can no longer ssh into my server from outside my local network. Both http and ssh timeout. Even if I cut out the dyndns stuff and just use the WAN IP, it still times out with OpenVPN connected, and works when I stop OpenVPN.
My OpenVPN provider (I do not control) that pushes routes to me (the client). Specifically, when connecting to the openvpn, the following commands are run:
/sbin/ifconfig tun0 10.15.0.74 pointopoint 10.15.0.73 mtu 1500 /sbin/route add -net 220.127.116.11 netmask 255.255.255.255 gw 192.168.1.1 /sbin/route add -net 0.0.0.0 netmask 18.104.22.168 gw 10.15.0.73 /sbin/route add -net 22.214.171.124 netmask 126.96.36.199 gw 10.15.0.73 /sbin/route add -net 10.15.0.1 netmask 255.255.255.255 gw 10.15.0.73
and the added routes are removed with
del when the vpn connection closes.
The problem is, this routes everything though the VPN. Instead, I would like my server to use the openvpn for all traffic other than ports 80 and 22 (inbound and outbound). i.e. I'd like to be able to connect to my server using http and ssh.
I believe similar questions have been asked, but they seem to be all routing specific ports throught the VPN and everything else, not though the vpn. I have not been able to adapt them for my purposes.
My router is 192.168.1.1 (a dd-wrt router). My guess is that ssh/http traffic should be marked and set to use 192.168.1.1 as the default gateway. However, im not sure how.
Following advice of leucos, I tried the following:
root@FILESERVER:~# curl ipecho.net/plain; echo ###.###.135.118 root@FILESERVER:~# echo "Connecting to OpenVPN in other terminal" Connecting to OpenVPN in other terminal root@FILESERVER:~# curl ipecho.net/plain; echo ###.###.164.93 root@FILESERVER:~# echo "1 NOVPN" >> /etc/iproute2/rt_tables root@FILESERVER:~# ip route add default via 192.168.1.1 dev p4p1 table NOVPN root@FILESERVER:~# ip route show table NOVPN default via 192.168.1.1 dev p4p1 root@FILESERVER:~# ip rule add from all fwmark 0x1 lookup NOVPN root@FILESERVER:~# iptables -t mangle -I PREROUTING -p tcp --dport 22 -j MARK --set-mark 1 root@FILESERVER:~# iptables -t mangle -I PREROUTING -p tcp --dport 80 -j MARK --set-mark 1 root@FILESERVER:~# curl ipecho.net/plain; echo ###.###.164.93
Now I'm not exactly sure how ipecho.net works, but my guess is that it has received something from ###.###.164.93, which (I guess) means port 80 traffic was not routed through p4p1 (my native interface), but instead was routed through tun0 (setup by OpenVPN). Trying to connect from outside my network also continued to timeout.