Connect to OpenVPN on server but still allow SSH connectivity

Question

I'm trying to setup an openvpn client on my Google cloud Ubuntu 18.04 VM, which will encrypt outbound traffic to my VPN provider and obfuscate my public IP.

I have done this before on other providers and it requires a custom route for allowing SSH into my server while it's connected to VPN (so return packets don't get sent out the VPN tunnel).

this is the workaround i've used before:

ip rule add table 128 from VPS_PUBLICIP

ip route add table 128 to VPS_PUBLICIP

ip route add table 128 default via DEFAULT_GATEWAY

However i can't get it working on my GCP vm. This following file runs at startup, along with a ping to my server which verifies the VPN is connecting:

ip rule add table 128 from 34.70.149.123

ip route add table 128 to 34.70.149.123

ip route add table 128 default via 10.128.0.1

here is the output of route -n on the server beforehand:

Destination Gateway Genmask Flags Metric Ref Use Iface

0.0.0.0 10.128.0.1 0.0.0.0 UG 100 0 0 ens4

10.128.0.1 0.0.0.0 255.255.255.255 UH 100 0 0 ens4

any help to get ssh routing correctly is appreciated

Answer 1

By default a GCE instances cannot forward packets originated by another resource.

So, in order to change the above, I suggest to double check if the IP forwarding feature is enabled for your instance.