I'm having a similar problem to this : Route everything through VPN except SSH on Port 22
But following those tips ended up locking me out of my server for good. I have a private OpenVPN server, to which I'm trying to connect to through another VPS. I only have access to both of these through ssh, so connecting with no extra arguments obviously locked me out of the client server. After having to shutdown the OpenVPN server to force close the connection, I looked into information how to achieve this, leading me to the link above, which blocked the VPS for good because those ip tables cannot be reverted.
I have a single IP on my VPS, here is the result of route -n :
Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.31.1.1 0.0.0.0 UG 0 0 0 eth0 172.31.1.1 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
And here is the result of ifconfig :
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet MY.ONLY.VPS.IP netmask 255.255.255.255 broadcast MY.ONLY.VPS.IP inet6 xxxx::xxxx:ff:xxxx:xxxx prefixlen 64 scopeid 0x20<link> inet6 xxxx:xxx:xxxx:xxxx::1 prefixlen 64 scopeid 0x0<global> ether xx:00:xx:xx:xx:xx txqueuelen 1000 (Ethernet) RX packets 10994 bytes 14763680 (14.7 MB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 2150 bytes 181928 (181.9 KB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 191 bytes 40527 (40.5 KB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 191 bytes 40527 (40.5 KB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
And here is my .ovpn config :
client ;dev tap dev tun ;dev-node MyTap ;proto tcp proto udp remote MYSERVER 1194 ;remote my-server-2 1194 resolv-retry infinite nobind # Downgrade privileges after initialization (non-Windows only) user nobody group nogroup # Try to preserve some state across restarts. persist-key persist-tun remote-cert-tls server key-direction 1 cipher AES-256-CBC script-security 2 up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf
What I'm trying to achieve, is to forward every request to the vpn, except ones in specific rules. Like requests coming from a specific server/hostname, or through a specific port like ssh. Thanks.