I am very new to Linux.

I have a PC at home with Ubuntu on it, connected to VPN using OpenVPN.

I would like to be able to connect to it with SSH from outside my network using my routers IP address and maybe be able to access ftp on it as well.

How can I do it?

Would that open my VPN connection so it is not safe any more?

Thank you for your help.

  • Some VPN providers offer port forwarding, meaning you can access services running on your machine from outside, using the VPN exit server's IP. – JonasCz - Reinstate Monica Jan 7 '18 at 9:53

Yes, you can connect to your Ubuntu PC from outside of your home network even though your Ubuntu PC is connected to an OpenVPN connection - only if you're behind a NAT router (which I'm going to assume you are, because hardly anyone connects directly to the Interwebs these days).

When you bring up your OpenVPN connection, a virtual "network interface" is created (probably called tun0). This interface will have its own IP address (probably something like 10.x.x.x), and the OpenVPN client is smart enough to set up "routing rules" (i.e. what traffic gets sent over what interface) so that local traffic is not sent over the VPN tunnel.

How can I do it?

  1. Log in to your home router.
  2. Set up a port forwarding rule to direct traffic on port x to port 22 on your Ubuntu PC.

That's it in a nutshell. Most home routers have a "port forwarding" feature. For the "external" port on your router, I would recommend using something other than the default (TCP port 22). For example, you could set up a port forwarding rule like: "forward incoming traffic on external TCP port 9922 to internal TCP port 22". Once you open TCP port 22 on the Internet, lots of folks will come a knockin' :). Just changing the port isn't "hardening" per se - you should also configure your SSH server to use key authentication and disable passwords altogether.

I cannot provide you with further details, because all home routers (and their interfaces) are different. You'll have to look in to how to set up port forwarding on your particular router. Here are some screenshots of port forwarding interfaces for different routers. Regardless of the interface, the concept is the same: You enter an external port (or, in some cases, "port range"), and the destination IP address and port. From the router's perspective, it can be thought of in plain English like this: "...when I receive external traffic on TCP port 9922, forward to TCP port 22 to local machine" (this is assuming you've set up TCP port 9922 to be forwarded to your Ubuntu box which has IP address and SSH Server listening on TCP port 22).

If you're exposing your SSH Server to the outside world, you should harden it as much as possible. As mentioned above, one quick win is to disable password authentication altogether and to enable public-key authentication.

Does that opens my VPN connection so it is not safe anymore?

Not sure how to answer this. Firstly, you should just assume you're "safe" just because you're connected to a VPN. I've seen some VPN providers leave all their user's open ports (services) exposed to everyone on the same VPN subnet. For example, VPN-User-A can access VPN-User-B's samba shares that are not password protected. The onus is on you to make sure your computers/devices are security hardened (to the best of your ability).

...SSH from outside my network using my routers IP address and maybe being able to access ftp on it as well

If you install and open up FTP to the outside world, then you're definitely not going to be "safe". It's best to keep your "open ports footprint" as small as possible. You can do just about anything over SSH. For example, SSH has a "sub-system" called "SFTP". To see this in action, you can open up your file manager and type in to the address bar:


(assuming your SSH Server is listening on IP address, port 9922). The problem, of course, is that not all operating systems/devices have a decent SSH client installed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.