Hi, I've set up a Raspberry Pi (distro Raspbian) at home as a media server which I regularly access from outside my network via SSH and other ports. Recently, I've decided to subscribe to a commercial VPN service after what I've configured my Raspbian with OpenVPN. After long hours of searching, reading and testing, I found out how to ssh into my server while it's redirecting all traffic from eth0 to tun0. Simply by running: [code] ip rule add from table 10 ip route add default via table 10 [/code] I added a couple of scripts in /etc/init.d/ to open the VPN connection on boot, and another script that runs the two lines above once the VPN connection is established. So, with the setup above, I can ssh into my server from work without a problem. My problem is that as soon the two ip commands above are ran, I can't ssh into my server locally (ie. ssh pi@192.168.0.170). I know this is what keeps me from connecting because if I remove the script from uptade-rc.d (which runs the two ip commands above), then I'm able to ssh into my server locally (but not remotely). And when I run these two ip commands, then the opposite happens: I can ssh remotely but not locally. Hope it all makes sense, and that you can put me in the right directions in regards to being able to ssh to the pi from both local and remote networks. Below are some configs that might be useful. Thanks a lot for your help in advance! [b]iptables[/b] [code] pi@raspberrypi /etc/iptables $ sudo iptables-save # Generated by iptables-save v1.4.14 on Fri May 29 10:27:22 2015 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [685:277225] :fail2ban-ssh - [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -m state --state INVALID -j DROP -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 32400 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 5850 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 4285 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 72 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT -A INPUT -s 192.168.0.0/24 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A INPUT -i eth0 -p tcp -m tcp --dport 58846 -j ACCEPT -A fail2ban-ssh -j RETURN COMMIT # Completed on Fri May 29 10:27:22 2015 [/code] [b]Routes - openvpn connection is closed[/b] [code] pi@raspberrypi /etc/iptables $ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 eth0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 [/code] [b]Sysctl setup as per [url="https://forums.openvpn.net/topic7163-15.html#p21267"]this[/url] post[/b] [code] pi@raspberrypi /etc/iptables $ sudo sysctl -a | grep \\.rp_filter net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.eth0.rp_filter = 1 net.ipv4.conf.lo.rp_filter = 1 [/code] [b]Route list[/b] [code] default via 192.168.0.1 dev eth0 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.170 [/code]

Please see the [b][color=#A40000]Forum rules[/color][/b] (top of page) Also please post route tables from your server and client (with or without VPN is ok).

Very sorry about that - and I can't see a way to edit my original post? So here it is: here's iptables-save again, since I've done a few tweaks [code] *filter :INPUT DROP [133:10274] :FORWARD DROP [0:0] :OUTPUT ACCEPT [2717:374078] :fail2ban-ssh - [0:0] -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A INPUT -i lo -j ACCEPT -A INPUT -m state --state INVALID -j DROP -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 32400 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 5850 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 4285 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 58846 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 8112 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 72 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -s 192.168.0.0/24 -j ACCEPT -A fail2ban-ssh -j RETURN -A fail2ban-ssh -j RETURN COMMIT [/code] I don't get why "-A fail2ban-ssh -j RETURN" appears here twice, when only called once in /etc/iptables/rules.v4 - output of it here: [code] *filter :INPUT DROP [65:8411] :FORWARD DROP [0:0] :OUTPUT ACCEPT [575:74020] -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A INPUT -i lo -j ACCEPT -A INPUT -m state --state INVALID -j DROP -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 32400 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 5850 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 4285 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 58846 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 8112 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 72 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -s 192.168.0.0/24 -j ACCEPT -A fail2ban-ssh -j RETURN -P INPUT DROP COMMIT [/code] OpenVPN client config file [code] client dev tun proto udp remote [xxx.yyy.com] [PORT] resolv-retry infinite nobind persist-key persist-tun ca ca.crt tls-client remote-cert-tls server auth-user-pass comp-lzo verb 1 reneg-sec 0 crl-verify crl.pem auth-user-pass [file.txt] [/code] ip rule show [code] 0: from all lookup local 32765: from 192.168.0.170 lookup 10 32766: from all lookup main 32767: from all lookup default [/code] ip route show table 10 [code] default via 192.168.0.1 dev eth0 [/code] iptables -L -v [code] Chain INPUT (policy DROP 440 packets, 30190 bytes) pkts bytes target prot opt in out source destination 0 0 fail2ban-ssh tcp -- any any anywhere anywhere multiport dports ssh 0 0 fail2ban-ssh tcp -- any any anywhere anywhere multiport dports ssh 226 145K ACCEPT all -- lo any anywhere anywhere 1 52 DROP all -- any any anywhere anywhere state INVALID 8362 1920K ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED 0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:32400 0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:5850 0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:4285 0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:58846 0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:8112 3 192 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:72 0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:http 0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:https 0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-request 106 16817 ACCEPT all -- any any 192.168.0.0/24 anywhere Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 9403 packets, 1399K bytes) pkts bytes target prot opt in out source destination Chain fail2ban-ssh (2 references) pkts bytes target prot opt in out source destination 0 0 RETURN all -- any any anywhere anywhere 0 0 RETURN all -- any any anywhere anywhere [/code] iptables -t nat -L -v [code] Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination [/code] As per the server config file, I don't believe I have/need one. I've used this tutorial to set things up : [url]https://dotslashnotes.wordpress.com/2013/08/05/how-to-set-up-a-vpn-private-internet-access-in-raspberry-pi/[/url] Thanks heaps for your help!

Sorry, I can not help with your iptables .. but I notice your server LAN is 192.168.0.0/24 [list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list] It may be worth you setting your server LAN to a more unique IP .. eg: 192.168.139.0/24

Thank you for your response. I've sorted the iptables issue now, obviously it was rookie mistake :roll:. And thanks for the server LAN address tip, I've now changed it to a more unique IP. Unfortunately, that hasn't resolved my issue. Maybe I should clarify that when the OpenVPN connection is established, I can locally ssh into my server, but can't remotely. Then if I run: [code] ip rule add from table 10 ip route add default via table 10 [/code] I can now ssh into my server from the outside world (using my ISP's given IP), but not locally anymore (ie. from my mac at home). Before I do my head [url=http://www.ichimonji10.name/blog/1/]in OpenVPN split routing[/url] or [url=http://www.evolware.org/?p=293]using Linux Network Namespaces for per processes routing[/url] I'd like to bother you guys one more/last time to know if perhaps a push command or adding a routing rule could solve my issue.. Cheers

Issues accessing my server via ssh locally

Desperateforajob

Hi,

I've set up a Raspberry Pi (distro Raspbian) at home as a media server which I regularly access from outside my network via SSH and other ports.
Recently, I've decided to subscribe to a commercial VPN service after what I've configured my Raspbian with OpenVPN.

After long hours of searching, reading and testing, I found out how to ssh into my server while it's redirecting all traffic from eth0 to tun0. Simply by running:

ip rule add from <internal IP of SSH server/VPN client> table 10
ip route add default via <internal IP of gateway/router> table 10

I added a couple of scripts in /etc/init.d/ to open the VPN connection on boot, and another script that runs the two lines above once the VPN connection is established. So, with the setup above, I can ssh into my server from work without a problem.

My problem is that as soon the two ip commands above are ran, I can't ssh into my server locally (ie. ssh pi@192.168.0.170).
I know this is what keeps me from connecting because if I remove the script from uptade-rc.d (which runs the two ip commands above), then I'm able to ssh into my server locally (but not remotely). And when I run these two ip commands, then the opposite happens: I can ssh remotely but not locally.

Hope it all makes sense, and that you can put me in the right directions in regards to being able to ssh to the pi from both local and remote networks.

Below are some configs that might be useful.

Thanks a lot for your help in advance!

iptables

pi@raspberrypi /etc/iptables $ sudo iptables-save
# Generated by iptables-save v1.4.14 on Fri May 29 10:27:22 2015
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [685:277225]
:fail2ban-ssh - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 32400 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 5850 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 4285 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 72 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i eth0 -p tcp -m tcp --dport 58846 -j ACCEPT
-A fail2ban-ssh -j RETURN
COMMIT
# Completed on Fri May 29 10:27:22 2015

Routes - openvpn connection is closed

pi@raspberrypi /etc/iptables $ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

Sysctl setup as per this post

pi@raspberrypi /etc/iptables $ sudo sysctl -a | grep \\.rp_filter
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.lo.rp_filter = 1

Route list

default via 192.168.0.1 dev eth0
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.170

Traffic

Please see the Forum rules (top of page)

Also please post route tables from your server and client (with or without VPN is ok).

maikcat

with the vpn on please post the output of:

ip rule show
ip route show table 10
iptables -L -v
iptables -t nat -L -v

Michael.

Desperateforajob

Very sorry about that - and I can't see a way to edit my original post? So here it is:

here's iptables-save again, since I've done a few tweaks

*filter
:INPUT DROP [133:10274]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [2717:374078]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 32400 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 5850 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 4285 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 58846 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 8112 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 72 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -j ACCEPT
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh -j RETURN
COMMIT

I don't get why "-A fail2ban-ssh -j RETURN" appears here twice, when only called once in /etc/iptables/rules.v4 - output of it here:

*filter
:INPUT DROP [65:8411]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [575:74020]

-N fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh

-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -i eth0 -p tcp -m tcp --dport 32400 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 5850 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 4285 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 58846 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 8112 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 72 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A INPUT -s 192.168.0.0/24 -j ACCEPT

-A fail2ban-ssh -j RETURN

-P INPUT DROP

COMMIT

OpenVPN client config file

client
dev tun
proto udp
remote [xxx.yyy.com] [PORT]
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 1
reneg-sec 0
crl-verify crl.pem
auth-user-pass [file.txt]

ip rule show

0:	from all lookup local
32765:	from 192.168.0.170 lookup 10
32766:	from all lookup main
32767:	from all lookup default

ip route show table 10

default via 192.168.0.1 dev eth0

iptables -L -v

Chain INPUT (policy DROP 440 packets, 30190 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 fail2ban-ssh  tcp  --  any    any     anywhere             anywhere             multiport dports ssh
    0     0 fail2ban-ssh  tcp  --  any    any     anywhere             anywhere             multiport dports ssh
  226  145K ACCEPT     all  --  lo     any     anywhere             anywhere
    1    52 DROP       all  --  any    any     anywhere             anywhere             state INVALID
 8362 1920K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp dpt:32400
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp dpt:5850
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp dpt:4285
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp dpt:58846
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp dpt:8112
    3   192 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp dpt:72
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp dpt:http
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp dpt:https
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
  106 16817 ACCEPT     all  --  any    any     192.168.0.0/24       anywhere

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 9403 packets, 1399K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain fail2ban-ssh (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     all  --  any    any     anywhere             anywhere
    0     0 RETURN     all  --  any    any     anywhere             anywhere

iptables -t nat -L -v

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

As per the server config file, I don't believe I have/need one. I've used this tutorial to set things up : https://dotslashnotes.wordpress.com/2013/08/05/how-to-set-up-a-vpn-private-internet-access-in-raspberry-pi/

Thanks heaps for your help!

Desperateforajob

Hi, me again.

Do you think the solution could be using Dockers or containers?
I'm also looking into the possibilities of using OpenVPN for only certain applications.

Cheers

Traffic

Sorry, I can not help with your iptables .. but I notice your server LAN is 192.168.0.0/24

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

It may be worth you setting your server LAN to a more unique IP .. eg: 192.168.139.0/24

Desperateforajob

Thank you for your response.
I've sorted the iptables issue now, obviously it was rookie mistake :roll:.

And thanks for the server LAN address tip, I've now changed it to a more unique IP. Unfortunately, that hasn't resolved my issue.

Maybe I should clarify that when the OpenVPN connection is established, I can locally ssh into my server, but can't remotely. Then if I run:

ip rule add from <internal IP of SSH server/VPN client> table 10
ip route add default via <internal IP of gateway/router> table 10

I can now ssh into my server from the outside world (using my ISP's given IP), but not locally anymore (ie. from my mac at home).

Before I do my head in OpenVPN split routing or using Linux Network Namespaces for per processes routing I'd like to bother you guys one more/last time to know if perhaps a push command or adding a routing rule could solve my issue..

Cheers