I use a dynamic DNS service which is sent ip address updates from my router. In router settings, ports 22 and 80 are forwarded to my server at 192.168.1.10. I have a webserver and sshd running on my server. From outside my local network, I can go to mydomain.dyndns.org, or ssh into my server. This works fine until I connect to OpenVPN. When I connect my server to my OpenVPN provider, I can no longer ssh into my server from outside my local network. Both http and ssh timeout. Even if I cut out the dyndns stuff and just use the WAN IP, it still times out with OpenVPN connected, and works when I stop OpenVPN.
My OpenVPN provider (I do not control) that pushes routes to me (the client). Specifically, when connecting to the openvpn, the following commands are run:
/sbin/ifconfig tun0 10.15.0.74 pointopoint 10.15.0.73 mtu 1500
/sbin/route add -net 141.255.164.66 netmask 255.255.255.255 gw 192.168.1.1
/sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.15.0.73
/sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.15.0.73
/sbin/route add -net 10.15.0.1 netmask 255.255.255.255 gw 10.15.0.73
and the added routes are removed with del
when the vpn connection closes.
The problem is, this routes everything though the VPN. Instead, I would like my server to use the openvpn for all traffic other than ports 80 and 22 (inbound and outbound). i.e. I'd like to be able to connect to my server using http and ssh.
I believe similar questions have been asked, but they seem to be all routing specific ports throught the VPN and everything else, not though the vpn. I have not been able to adapt them for my purposes.
EDIT:
My router is 192.168.1.1 (a dd-wrt router). My guess is that ssh/http traffic should be marked and set to use 192.168.1.1 as the default gateway. However, im not sure how.
EDIT 2:
Following advice of leucos, I tried the following:
root@FILESERVER:~# curl ipecho.net/plain; echo
###.###.135.118
root@FILESERVER:~# echo "Connecting to OpenVPN in other terminal"
Connecting to OpenVPN in other terminal
root@FILESERVER:~# curl ipecho.net/plain; echo
###.###.164.93
root@FILESERVER:~# echo "1 NOVPN" >> /etc/iproute2/rt_tables
root@FILESERVER:~# ip route add default via 192.168.1.1 dev p4p1 table NOVPN
root@FILESERVER:~# ip route show table NOVPN
default via 192.168.1.1 dev p4p1
root@FILESERVER:~# ip rule add from all fwmark 0x1 lookup NOVPN
root@FILESERVER:~# iptables -t mangle -I PREROUTING -p tcp --dport 22 -j MARK --set-mark 1
root@FILESERVER:~# iptables -t mangle -I PREROUTING -p tcp --dport 80 -j MARK --set-mark 1
root@FILESERVER:~# curl ipecho.net/plain; echo
###.###.164.93
Now I'm not exactly sure how ipecho.net works, but my guess is that it has received something from ###.###.164.93, which (I guess) means port 80 traffic was not routed through p4p1 (my native interface), but instead was routed through tun0 (setup by OpenVPN). Trying to connect from outside my network also continued to timeout.
route-nopull
for that. Then what? :-)