I've got a remote home server running Debian. I happen to use SSH on a non-standard port due to ISP blocking port 22. I've got no issues connecting to SSHd from outside of my network with the OpenVPN client not running on the server. The second I start OpenVPN client I get the following:

$ ssh -v -p 922 domain.dyndns.org
OpenSSH_6.7p1 Debian-5+deb8u3, OpenSSL 1.0.1t  3 May 2016
debug1: Reading configuration data /home/user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to domain.dyndns.org [] port 922
debug1: connect to address port 922: Connection timed out
ssh: connect to host domain.dyndns.org port 922: Connection timed out

I have a dynamic IP address but the server is behind a router so I can't think to bind sshd to the public address. Even if it could, I'm not convinced the packets wouldn't get lost through the tun0.

On my travels of the Internet to try and resolve this issue, I found the following script.

grep -q fix_ssh /etc/init.d/openvpn || sed -i.backup -e '/start_vpn ()/ i fix_ssh () {\
ip rule add fwmark 65 table novpn\
ip route add default via dev eth0 table novpn\
ip route flush cache\
iptables -t mangle -A OUTPUT -p tcp --sport 922 -j MARK --set-mark 65\
iptables -A INPUT -i tun0 -p tcp -m tcp --dport 922 -j DROP\
undo_fix_ssh () {\
iptables -D INPUT -i tun0 -p tcp -m tcp --dport 922 -j DROP\
iptables -t mangle -D OUTPUT -p tcp --sport 922 -j MARK --set-mark 65\
ip route del default via dev eth0 table novpn\
ip rule del fwmark 65 table novpn\
ip route flush cache\
   -e 's/start_vpn$/& \&\& fix_ssh/' \
   -e 's/stop_vpn$/& \&\& undo_fix_ssh/' \

I've tried running it to no success. Comparing to other answers I've found, I'm not entirely sure where the issue lies with this solution and I've run out of ideas for troubleshooting.

I'm not entirely sure what the best approach to the issue is. The OpenVPN service is a commercial service I don't control.

Edit: My goal is to be able to SSH into the SSH serve whilst it is running and connected to the OpenVPN server. I want all other traffic to go through the VPN. Eventually I want to use SSHFS to be able to view files on the SSH server and then port forwarding so my laptop miles away can share the same VPN connection.

------------ ---------------- |My Server |--->OpenVPN>---|Commercial VPN |-->Internet>--Web ------------ Over internet | Server | | ----------------- /|\ SSH Over Internet /|\ ---------- | Laptop | ----------

Edit 2: No, Laptop is in a different location to the SSHd server. Edited picture again for clarity.

Edit 3: There is a router involved. The server is behind a router. tun0 is the OpenVPN connection.

$ sudo /sbin/iptables-save # Generated by iptables-save v1.4.14 on Mon Dec 26 13:03:22 2016 *mangle :PREROUTING ACCEPT [11077726:5767595109] :INPUT ACCEPT [9445198:5734927839] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [10132207:7571233156] :POSTROUTING ACCEPT [10132784:7571256515] -A OUTPUT -p tcp -m tcp --sport 922 -j MARK --set-xmark 0x41/0xffffffff COMMIT # Completed on Mon Dec 26 13:03:23 2016 # Generated by iptables-save v1.4.14 on Mon Dec 26 13:03:23 2016 *filter :INPUT ACCEPT [9445173:5734925686] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [10132201:7571259291] -A INPUT -i tun0 -p tcp -m tcp --dport 922 -j DROP COMMIT # Completed on Mon Dec 26 13:03:23 2016

Edit: Am I going to be better off having something like a Raspberry pi to ssh into to avoid this? Would I run into different difficulties? I'm still not sure of the root cause to know if this would resolve anything. Is a chain of SSH tunnels bad form? Idea being:

[Laptop]->SSH->--------->-[Pi]-Same Network->-[My Server]->-[OpenVPN]


Edit: Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface UG 0 0 0 tun0 UG 0 0 0 eth0 UGH 0 0 0 tun0 UH 0 0 0 tun0 UG 0 0 0 tun0 UGH 0 0 0 eth0 U 0 0 0 eth0

Contents of a .ovpn file: client dev tun proto udp remote server 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt tls-client remote-cert-tls server auth-user-pass auth.txt comp-lzo verb 1 reneg-sec 0 crl-verify crl.pem

# Allow calling of built-in executables and user-defined scripts. script-security 2

# Parses DHCP options from openvpn to update resolv.conf up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf

  • Can you draw some ascii art of your setup, and can you tell us what you are trying to achieve? I think you have at least the following things, a server which is sometimes running the openvpn software and an ssh server on port 922. This sits on a LAN, which is connected to the world via a typical home router. This has a WAN address of domain.dyndns.org and forwards connections on port 922. There must be the endpoint of your openvpn connection somewhere, then you have the machine where you are running your ssh -v -p 922 command, which network is it connected to? – icarus Dec 25 '16 at 2:35
  • Thanks for the edit. Does this mean that Laptop and My Server are on the same LAN (typically something like 192.168.1.x for a home machine)? All that this would seem to require is that the routing table on My Sever knows to send local traffic to the local lan rather than to the Commercial VPN Server. – icarus Dec 25 '16 at 18:42
  • Things are clearer now (pity there is no router in the diagram, unless My Server is directly exposed to the internet). Next we need your openvpn, routing and iptables configuration. Are you using tun or tap devices? Assuming TUN, the basic idea is to set up NAT for all outgoing TCP packets except for ones with a source port of 922, with the NAT packets going down the OpenVPN connection. Can you show us the output of iptables-save from the server with the openvpn connection enabled, – icarus Dec 25 '16 at 20:53
  • I suspect you've got a redirect-gateway def1 in your OpenVPN configuration, which means that when the tunnel is active ALL traffic goes down the VPN connection - including attempts to reply to your inbound ssh requests. Please confirm the redirect-gateway element and we can continue from there. – roaima Jan 3 '17 at 11:33
  • @roaima How would I confirm that please? – TechnicallyTroubled Jan 3 '17 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.