I'm having a similar problem to this : Route everything through VPN except SSH on Port 22

But following those tips ended up locking me out of my server for good. I have a private OpenVPN server, to which I'm trying to connect to through another VPS. I only have access to both of these through ssh, so connecting with no extra arguments obviously locked me out of the client server. After having to shutdown the OpenVPN server to force close the connection, I looked into information how to achieve this, leading me to the link above, which blocked the VPS for good because those ip tables cannot be reverted.

I have a single IP on my VPS, here is the result of route -n :

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 eth0 UH    0      0        0 eth0

And here is the result of ifconfig :

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet MY.ONLY.VPS.IP  netmask  broadcast MY.ONLY.VPS.IP
    inet6 xxxx::xxxx:ff:xxxx:xxxx  prefixlen 64  scopeid 0x20<link>
    inet6 xxxx:xxx:xxxx:xxxx::1  prefixlen 64  scopeid 0x0<global>
    ether xx:00:xx:xx:xx:xx  txqueuelen 1000  (Ethernet)
    RX packets 10994  bytes 14763680 (14.7 MB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 2150  bytes 181928 (181.9 KB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
    inet  netmask
    inet6 ::1  prefixlen 128  scopeid 0x10<host>
    loop  txqueuelen 1000  (Local Loopback)
    RX packets 191  bytes 40527 (40.5 KB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 191  bytes 40527 (40.5 KB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

And here is my .ovpn config :


;dev tap
dev tun

;dev-node MyTap

;proto tcp
proto udp

remote MYSERVER 1194
;remote my-server-2 1194

resolv-retry infinite


# Downgrade privileges after initialization (non-Windows only)
user nobody
group nogroup

# Try to preserve some state across restarts.

remote-cert-tls server
key-direction 1

cipher AES-256-CBC

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

What I'm trying to achieve, is to forward every request to the vpn, except ones in specific rules. Like requests coming from a specific server/hostname, or through a specific port like ssh. Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.