Remote access to web server while openVPN is on?

Question

My setup:

Router: 192.168.2.1 with port forwarding to 192.168.2.3 (external 8080 because my ISP blocks 80, internal 80.)

Pi4: 192.168.2.3 with Apache running to process occasional requests from my voip provider.

I can access my apache server both via LAN 192.168.2.3 and externally via DDNS myhostname.myddns.com:8080.

However, when I turn on openvpn to my external vpn provider on Pi4, I can access my server via LAN 192.168.2.3, but I can no longer access it externally via ddns.

Is there a way to make it work?

Many thanks.

With VPN on:

root@raspberrypi:~# ip addr
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0:  mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether dc:a6:32:a5:81:28 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.3/24 brd 192.168.2.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::d51a:611:3ca0:3c97/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: wlan0:  mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether 86:e5:4b:8b:d9:a8 brd ff:ff:ff:ff:ff:ff
5: tun0:  mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 25.0.8.11/24 brd 25.0.8.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::278e:69ba:a47d:1247/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

root@raspberrypi:~# ip route
0.0.0.0/1 via 25.0.8.1 dev tun0 
default via 192.168.2.1 dev eth0 proto dhcp src 192.168.2.3 metric 202 
25.0.8.0/24 dev tun0 proto kernel scope link src 25.0.8.11 
103.136.40.134 via 192.168.2.1 dev eth0 
128.0.0.0/1 via 25.0.8.1 dev tun0 
192.168.2.0/24 dev eth0 proto dhcp scope link src 192.168.2.3 metric 202 

With VPN off

root@raspberrypi:~# ip addr
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0:  mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether dc:a6:32:a5:81:28 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.3/24 brd 192.168.2.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::d51a:611:3ca0:3c97/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: wlan0:  mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether 86:e5:4b:8b:d9:a8 brd ff:ff:ff:ff:ff:ff
root@raspberrypi:~# ip route
default via 192.168.2.1 dev eth0 proto dhcp src 192.168.2.3 metric 202 
192.168.2.0/24 dev eth0 proto dhcp scope link src 192.168.2.3 metric 202 

Answer 1

It seems the following ip rules I found online solved the problem. For now, ipleak.net test seems fine.

ip rule add from 192.168.2.3 table 128
ip route add table 128 to 192.168.2.0/24 dev eth0 
ip route add table 128 default via 192.168.2.1

I could not get iptable persistent working in the latest Raspberry Pi OS following the steps suggested by comment below. I added the rules to /etc/rc.local instead.