Accessing ssh over public ip address after configuring with VPN

Question

I looked at this but it appears to be a guide to recovering a borked setup.

Using PIA (Private Internet Access) and Openvpn, I can setup my raspberry to use a VPN. However, connecting to its public address (forwarded through the router) no longer works. By no longer working, I mean the raspberry does not receive the connection. I even stopped the ssh process and started a netcat listen on port 22 to see if it got anything - but it doesn't (it did through LAN).

Connecting through the LAN works fine as usual for ssh.

Stopping the VPN services restores ssh access.

Is it possible to have both the publicly forwarded 22 port and using a VPN work at the same time?

Command to initiate the VPN access

cd /etc/openvpn/pia && sudo openvpn file.ovpn

file.ovpn

client                                                                      
dev tun                                                                     
proto udp                                                                   
remote xxxx.privateinternetaccess.com 1198                                  
resolv-retry infinite                                                       
nobind                                                                      
persist-key                                                                 
persist-tun                                                                 
cipher aes-128-cbc                                                          
auth sha1                                                                   
tls-client                                                                  
remote-cert-tls server                                                      
auth-user-pass                                                              
comp-lzo                                                                    
verb 1                                                                      
reneg-sec 0                                                                 
crl-verify crl.rsa.2048.pem                                                 
ca ca.rsa.2048.crt                                                          
disable-occ                                                                 
auth-user-pass xxxx

Answer 1

It has been my experience with VPN that once you connect to the VPN, you are part of THAT network and are shut off from your local network. I recall, for example, being on my employer's VPN and not being able to use my home network printer.

That being said, I think that what you need is VPN split tunneling. However, PIA specifically does not support split tunneling: https://helpdesk.privateinternetaccess.com/hc/en-us/articles/229653027-Can-I-Exclude-An-Application-From-Using-The-PIA-Software-

I too use PIA but have not tried to do what you are doing. PIA says it supports 5 simultaneous connections. If I were you, I would take my second machine (the one that wants to run ssh client) and also connect it to my PIA VPN account. Now you have both machines on the same network. Now try to connect using machine #1's address on the VPN.

Answer 2

After connecting to the VPN, the Pi's public IP address is no longer the same as the router's IP address; It is now a PIA VPN public IP address. You should be able to configure your Pi's PIA VPN public IP address to forward the SSH port to your raspberry pi.

Then, instead of connecting to your router's public IP address when you want to SSH into your Pi from abroad, connect to the Pi's PIA VPN public IP address.

PIA has a couple of posts about port forwarding that might help:

Basic (using PIA application)

Advanced (not using PIA application)

Answer 3

I'm guessing with incomplete information here, but if your configuration is typical of how people use VPNs from their PCs out to "the Internet" the issue here is most likely your default route.

If you type ip route you'll see you have a set of routes that determine, based on destination address, to where your computer will send packets. For locally connected networks your computer can talk directly to the destination host, so it hands any packet for it directly to that host. For most random IP addresses out on the Internet you have no specific route like this and so the default route is used.

When the VPN is not up, your default route points to your local Internet router. When sending a packet using this route your computer will set the packet's destination IP address to the final destination, the packet's source address to the LAN interface it's using to talk to the Internet router, and then send that packet to the Internet router, relying on it to forward it further towards the final destination.

When you start the VPN, it probably changes your default route to send packets to the router at the other end of the VPN link rather than your local Internet router. So when you send a packet via this new default route, it's now sent to that VPN link router with the packet's source address set to the address of the VPN interface that has direct communication with that VPN router.

This isn't good for communication of course, because in most cases when someone sends a packet to the first (non-VPN) address, it's not going to consider a reply from the second, different, VPN address to be a reply to the packet it originally sent.

You can confirm if this is the problem by viewing a site such as whatismyip.com in your browser before and after you start the VPN. You will probably see that beforehand your address is the one assigned to you by your local ISP, and afterwards your address is a different one assigned to you by your VPN provider.

If this is the case, your question is actually this one from the Unix and Linux StackExchange, and the accepted answer is your solution.