I have a server ( that I use as a router/default gateway. This server connects to an openvpn and routes all network through this vpn before sending it (encrypted) to the modem ( I have configured port forwarding so that SSH connections on my public IP get routed to the server. The IP from the vpn can't be used to connect to the server.

Whenever I disconnect the vpn I can access the server with SSH from a remote location but when routing through the VPN this is impossible. This all seems logical as the server tries to reply from a different IP.

What I wish is want the server keeps routing my LAN traffic through the VPN but accepts SSH on my public IP. Thus if you will routing all traffic from the modem to the server and back to the modem again. I could then specify rules on the server that only allow SSH connections. Another perhaps better option is that only SSH (22) gets routed through the modem. The problem is that I can't get this routing from the modem to server and back again to work.

What I tried:

I found this source where they suggest the following:

ip rule add from table 128
ip route add table 128 to dev eth0
ip route add table 128 default via

Which feels like undoing all the previous vpn routing I have done before. Whenever I do this I can still acces the server from a remote location but the VPN won't work anymore.


I have a solution that does not do exactly what I want but perhaps it will help some people out. You will at least be able to access the server from a remote location while it is behind a VPN.

What you could do is set up a reverse SSH tunnel to another server not behind a VPN or use a service that provides tunnels such as openport. These services are easy to set up but won't allow you to use your own IP (and often port) to connect.


I would try fooling around with iptables on the server.

I am using openvpn, and use the following commands to deal with ssh:

-A INPUT -s 17#.48.#.##/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT

-A INPUT -i tun0 -p tcp -m tcp --dport 22 -m iprange --src-range -j ACCEPT

Where the first rule allows only from my source IP(primary workstation)

and the second allows from any device connected to the vpn, so if I can connect to my vpn, I can connect to ssh regardless of device.

The trick I have found is using the existence of /dev/tun0 to your advantage, as very few devices(yours), have access to it.

I am no expert, and I am not certain of the possible security risks of these rules, but they work for me. Maybe tweaking them a bit will get you what you need.

Not sure if this is exactly what you are looking for but I hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.