SSH into Raspberry Pi connected to OpenVPN

Question

I want to be able to remotely ssh into my rpi, while my rpi is connected to PIA (via OpenVPN). I can ssh into the pi from my local network while the pi is connected to OpenVPN, and I can also ssh into the pi remotely while the pi is not connected to OpenVPN. But when I try to ssh into the pi remotely while the pi is connected to OpenVPN I get a connection timeout.

My idea was to connect to PIA, request port forwarding, set the ssh port to the port being forwarded, and then ssh pi@PIA_IP -p PIA_PORT. I thought this would work but I just get a connection timeout.

I tried these commands to route ssh traffic through my router, but still get connection timeout:

sudo ip route add default via <ROUTER_IP> table 65
sudo ip route flush cache
sudo iptables -t mangle -A OUTPUT -p tcp --sport 22 -j MARK --set-mark 65

EDIT: got it work work by doing this:

sudo ip rule add fwmark 65 table novpn
sudo ip route add default via <LOCAL_ROUTER_IP> dev eth0 table novpn
sudo ip route flush cache
sudo iptables -t mangle -A OUTPUT -p tcp --sport 2022 -j MARK --set-mark 65
sudo iptables -A INPUT -i tun0 -p tcp -m tcp --dport 2022 -j DROP

After running these commands, start OpenVPN. Then I forwarded port 2022 on my router to my pi, and connected with:

ssh pi@<PUBLIC_ROUTER_IP> -p 2022

Answer 1

The problem is with the routing. You try to connect from remote to the PI, but the return packets are routed through the VPN. The port forwarding might work, you have to find out where it goes wrong.

A solution to the routing problem is policy routing. Create a rule:

ip rule add sport 22 table 222

This assumes that 22 is your SSH port, the table number 222 is arbitrary, you just have to use the same number in the route command that follows:

ip route add default via 1.2.3.4 table 222

Replace 1.2.3.4 with the address of your router.

These two commands together make sure that packets coming from port 22, that is return packets from the SSH connection, go through your router.

If you want to use SSH over the VPN, you have to assign a different port for SSH over VPN from the direct SSH port, because the return packets will not go over the VPN with there rules.