VPN for internet but not for local network? (Raspberry Pi)

tres · 2 Jul 2020 at 15:01

Hi all

I started playing with a Raspberry Pi. What a great little machine.
I've set up a VPN so it does some downloading from the internet, which works great.
But now I can't SSH into it from a local laptop
I can still get in via cloud VNC

Can anyone point me in the right direction of how I can fix this? Routing local addresses? I've impressed myself by getting this far but I need help now!! Thanks

(Using Raspberry Pi OS, RPi connected to router via ethernet)

kosymodo · 2 Jul 2020 at 15:32

Did you create the extensionless file 'ssh' in the root directory?

tres · 2 Jul 2020 at 15:47

kosymodo said:
Did you create the extensionless file 'ssh' in the root directory?

No although i enabled SSH, and could SSH into it when the VPN was inactive

kosymodo · 2 Jul 2020 at 16:06

That was my only idea I'm afraid - I'm also new to the Pi, and have so far only used it headless as a Pi-hole. I just remembered I had to add the 'ssh' file, and thought it might also apply in your case. I guess not!

Rainmaker · 2 Jul 2020 at 19:24

What VPN? OpenVPN? WireGuard? What's the output of ip route? It sounds like you just need to (re)add a route to your local network. If it's WireGuard (eg PiVPN) then it's easy, you can just add the requisite commands to your .conf file. If it's OpenVPN it's still fairly easy just needs an extra step or two. First things first, try this:

Code:

sudo ip route add 192.168.1.0/24 via 192.168.1.1

Replace 192.168.1.0/24 with the appropriate subnet for your network. Note the 0 on the end of the first number; it's not the address of the Pi or router! The second address is just your router's address, so replace as required. Then try SSH again. Are you running a firewall (eg ufw)? You may need to add sudo ufw allow ssh or sudo ufw allow from 192.168.1.0/24 (replace with your own subnet address).

If you have OpenVPN (or WireGuard from certain providers) there's a chance there's a firewall 'kill switch' built into the config to drop all traffic except VPN. This would include the local network. If you're really stuck just reply with what type of VPN it is, the config file (redact any keys/passwords!) and the output of the route command above.