So I have a WD MyCloud EX2 using openVPN to connect to a paid VPN service, but I still want to have access to my ssh,ftp, and plex ports (22,20-21,32400) from an external network using port forwarding to the local network. I'm aware I can setup port forwarding on the VPN server and my provider allows for that, but the ip always changes and I don't want to go through the VPN providers. I am able to access these ports by default when on the local network with the NAS (and when using openVPN to route into the local network), but I am unable to connect using port forwarding (it stops working once I enable the NAS VPN). I tried some basic Iptables rules such as iptables -A OUTPUT -p tcp -m tcp --dport 32400 -j AC but they do not seem to work. I've seen various posts about attempting similar things but they seemed either supeDoes anyone has any ideas on how to allow the NAS to bypass openVPN for specific ports? Thanks


The problem is likely because of routing. Most likely, your VPN provider pushes routes that force your device to use the VPN server as the default gateway. Usually, it will push and, as these two routes combined will cover the entire IPv4 address space, and still allow you to talk to your immediate upstream gateway and local network(s), as they take precedence since they have larger prefixes (e.g. /24).

This means that if your VPN client receives a packet from a host on the internet (e.g. on its eth0 interface, for example, it will match the route and get sent to your VPN server. is not expecting a packet from your VPN server, and thus the connection fails to be established. What you want is for the reply packet to be sent out from eth0, back out the way the initial packet came in.

This can be accomplished with routing policy on the machine that is the VPN client that you need to access with port forwarding. See this similar question and the first answer: Reply on same interface as incoming?

To quote:

echo 200 isp2 >> /etc/iproute2/rt_tables
ip rule add from <interface_IP> dev <interface> table isp2
ip route add default via <gateway_IP> dev <interface> table isp2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.