I am basically trying to SSH into a RPi that is always connected to a VPN, which makes SSH fails. I received few ideas on how to solve the issue, and the best IMHO is to make the SSH traffic go through a 2nd routing table.

The problem is this is rather complicated for a network noob like me. So I was wondering whether I could get some pointers to get started, as I am completely lost. Especially on how to mark SSH traffic to go through the 2nd table.



EDIT: Thanks again for the answer Marius. I finally found some time to work on this, and here is what I have done.

  1. sudo modprobe ip_conntrack
  2. sudo iptables -A INPUT -m state --state NEW -p tcp --dport 22 -j CONNMARK --set-mark 1
  3. then as root:
  4. echo 200 hma >> /etc/iproute2/rt_tables
  5. ip route add dev eth0 table hma
  6. ip rule add fwmark 1 table hma

but it does not seem to work. As I am really not sure as to what to do, this is not really a surprise.

More specifically, I am really unsure about 2) and 4). Is 2) correct at all? And for 4), where do I find the right IP to add, what does the /24 mean, and should it go through eth0 (my vpn appears to be tun0)?

Thanks again

EDIT2: After a reboot, I have actually lost SSH access to the pi :(


It is actually very easy, luckily for all of us: let me call IP2 the IP address of the localhost in the second routing table. Then all you have to do is:

      ssh -b IP2 me@some_remote_machine 

The -b option instructs ssh to bind (i.e., use as source address) to the IP address IP2. If you have already setup the second routing table, with a rule like

      ip rule from IP2 table2

where table2 is the second routing table, you are good to go.

  • answer in main post – user20224 Oct 24 '15 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.