You need to add routing to your server so ssh packets get routed via the server's public ip not the vpn. Failing to do that means the ssh return packet gets routed via openvpn. This is why you get locked out of your server after you've inititated an openvpn client session.
Lets assume your server's:
- Public IP is
- Public IP Subnet is
- Default Gateway is
eth0 is device to gateway
iproute2 is your friend here. Do the following:
ip rule add table 128 from a.b.c.d
ip route add table 128 to a.b.c.0/24 dev eth0
ip route add table 128 default via x.x.x.1
route -n to confirm new routing table shows up.
Above commands won't persists if you reboot the server. You'll need to add them to your network interface config file.
Then run your openvpn client config
openvpn --config youropenvpn-configfile.ovpn &
Also, should you wish to restrict traffic to your public IP to ssh and only ssh then you'll need to add
iptables filtering as follows:
iptables -A INPUT -d a.b.c.d -p tcp --dport <*ssh port number*> -j ACCEPT
iptables -A INPUT -d a.b.c.d -j DROP
ps: I recall first learning about this in the Linode's forum - google it and you should be able to find a post on this.