1

I want to be able to remotely ssh into my rpi, while my rpi is connected to PIA (via OpenVPN). I can ssh into the pi from my local network while the pi is connected to OpenVPN, and I can also ssh into the pi remotely while the pi is not connected to OpenVPN. But when I try to ssh into the pi remotely while the pi is connected to OpenVPN I get a connection timeout.

My idea was to connect to PIA, request port forwarding, set the ssh port to the port being forwarded, and then ssh pi@PIA_IP -p PIA_PORT. I thought this would work but I just get a connection timeout.

I tried these commands to route ssh traffic through my router, but still get connection timeout:

sudo ip route add default via <ROUTER_IP> table 65
sudo ip route flush cache
sudo iptables -t mangle -A OUTPUT -p tcp --sport 22 -j MARK --set-mark 65

EDIT: got it work work by doing this:

sudo ip rule add fwmark 65 table novpn
sudo ip route add default via <LOCAL_ROUTER_IP> dev eth0 table novpn
sudo ip route flush cache
sudo iptables -t mangle -A OUTPUT -p tcp --sport 2022 -j MARK --set-mark 65
sudo iptables -A INPUT -i tun0 -p tcp -m tcp --dport 2022 -j DROP

After running these commands, start OpenVPN. Then I forwarded port 2022 on my router to my pi, and connected with:

ssh pi@<PUBLIC_ROUTER_IP> -p 2022
|improve this question
  • What is PIA? Is it your home internet router? Where is the entry point of the OpenVPN tunnel? On the local RasPi or on the home internet router or on any other device? Do you have a OpenVPN server running? Where is the other end of the OpenVPN tunnel? On your remote device? – Ingo Jun 30 '19 at 0:41
  • Private Internet Access (PIA) is the vpn service. My RPI is running openvpn to connect to PIA, and then I try to ssh into the pi from my computer – yawers Jun 30 '19 at 1:04
  • I know how OpenVPN works in peer to peer mode or in client/server mode, either routed with tun devices or bridged with tap devices. But I don't know how PIA works. Is it a free service on the internet? – Ingo Jun 30 '19 at 1:59
  • Its a vpn service so you connect to their server – yawers Jun 30 '19 at 3:25
  • As far as I understand you have an openvpn tunnel from the RasPi to the PIA server on the internet so ssh traffic goes through this tunnel. Then port forwarding for ssh port 22 doesn't make sense. I would think you have to use port forwarding for openvpn, by default 1194. – Ingo Jun 30 '19 at 8:24
2

The problem is with the routing. You try to connect from remote to the PI, but the return packets are routed through the VPN. The port forwarding might work, you have to find out where it goes wrong.

A solution to the routing problem is policy routing. Create a rule:

ip rule add sport 22 table 222

This assumes that 22 is your SSH port, the table number 222 is arbitrary, you just have to use the same number in the route command that follows:

ip route add default via 1.2.3.4 table 222

Replace 1.2.3.4 with the address of your router.

These two commands together make sure that packets coming from port 22, that is return packets from the SSH connection, go through your router.

If you want to use SSH over the VPN, you have to assign a different port for SSH over VPN from the direct SSH port, because the return packets will not go over the VPN with there rules.

|improve this answer
  • I didn't get that to work, just edited my post with what I tried – yawers Jun 30 '19 at 1:07
  • Well, the commands you posted are only slightly related to what I suggested. ANyway, you should run tcpdump to see what packets arrive and what gets returned. – RalfFriedl Jun 30 '19 at 8:15
  • Thanks for your help, I got it to work with something similar to what you suggested (I don't have enough rep to vote up). – yawers Jun 30 '19 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.