Excluding some network services from VPN

Question

My local linux server is connected to the internet via router. Router (192.168.0.1) does NAT from ISP assigned IP address (which changes from time to time) to server's local IP (192.168.0.102).

When server connects to VPN (PrivateInternetAccess), and tun0 adapter starts (with different IP every time) all of the forwarded services (like web server) can no longer be accessed from outside networks.

How can I configure the server to hear and respond to http(s), ssh(running on non-standard port) and ftp requests while VPN is running. It does not matter to me whether that specific traffic goes through VPN as long as all the other traffic does.

Answer 1

You need to look at your routing tables and see which destination IP addresses are routed through your VPN:

ip route

All of your traffic is probably routed through the VPN (at the exception of the LAN addresses and the VPN endpoint). This means that the packets of your services are routed throught the VPN (with you local -- and private -- IP addresses). Those packets are dropped somewhere in the remote network (probably at the VPN endpoint) because:

• they are (probably) not using the remote network addresses;

• they are private (non-routable) addresses;

• even if they were not filtered (and a NAT was used), they would be NATed to the IP addresses of the remote network.

You need to have those packets routed through you local gateway.

You can do something like this to force packets using your local IP as a source address to go through the local gateway:

# Your IP address:
ip rule add from 192.168.0.42 table 42
ip route add default via 192.168.0.1 table 42

This should work for TCP services. You might have issues for UDP services which might response with your VPN address to queries made on your local IP address: in this case, you can probably use iptables to either rewrite the source IP address of the packets or tag them (-j MARK --set-mark 42 and fwmark 42) based on the UDP port.

Answer 2

The problem here is that all traffic is being routed down the VPN tunnel. This should be resolved by enabling split tunneling for the VPN. How to do that depends on the server and client software in use.