Installed OpenVPN with PIA but no longer access to my VPS

Paula

Is there a way to allow VNC connections to my VPS while still having Private Internet Access in place? It seems that once OpenVPN/PIA is running, I can no longer connect to my VPS since it routes all traffic via PIA.
I am using Ubuntu 16.04 with Lubuntu GUI.

Thanks for any help!

Ympker

Pretty sure this wont work with pia

robinex

Most VPN service Programs not use openvpn. They are support openvpn but their programs use IKEv2. if work want use VPN on VPS you must use openvpn apps with vpn service opvn config files.

if you were using windows, I give my own apps. I coded on vb.net.
My apps working logic : İf windows RDP connection drop, Detect this and kill vpn connection apps so network gone back original.

Maybe you will find for linux this logic or use only openvpn with config files.

good luck

mksh

This is very likely routing related. You have a couple options:

• Crappy but easy way: Set a route for the IP (range?) you are using to connect to the VPS.
• Another crappy but easy way: Do not use a default route for the VPN but set routes for the destinations you want to route through it.
• Good but hard way out: Setup routing by port or user. This will involve iptables magic and an unconventional routing setup though.

I'd only attempt the third option if you are comfortable with CLI, somewhat familiar with iptables, have at least a basic grasp on routing and preferably a VNC console to debug your config in case of lock outs.

Paula

@mksh said:
This is very likely routing related. You have a couple options:

• Good but hard way out: Setup routing by port or user. This will involve iptables magic and an unconventional routing setup though.

In my case, I only need torrent to be going through VPN, so it is possible to configure OpenVPN to be only used bythe ports of the torrent client? And thus leave TLS to the VPS untouched?

mksh

@Paula said:

@mksh said:
This is very likely routing related. You have a couple options:

• Good but hard way out: Setup routing by port or user. This will involve iptables magic and an unconventional routing setup though.

In my case, I only need torrent to be going through VPN, so it is possible to configure OpenVPN to only allow the ports used by the torrent client?

Yes it's possible (might be a bit more complicated with a properitary client but i guess you could still apply the required settings) . Routing by port is a bit exotic though. Basic routing goes by destination IP and everything else is a bit of a pain. In your case it would go something like this:

• You either avoid the VPN pushing a default route or if not possible with this client setup scripting to remove it again (if-up hooks, cron job, ... something like this).
• You setup iptables rules (in the prerouting chain of mangle iirc) to mark the packets you want to route over the VPN (source port, destination port, user, protocol, pretty much anything is possible).
• You add add a custom routing table with nothing but a route for the VPN.
• You add a routing rule that makes to marked packets use the table you've just added.
• Edit: Since you are using Ubuntu you might have to disable reverse path filtering to get this to work.
• Profit.

That's the basic idea. Getting this right is kinda annoying though. That's why i wouldn't attempt it without some prior knowledge and a way to debug. If you feel like you want to try i can go a bit more into detail but it's not like i can just give you a foolproof step by step howto.

Word of caution with torrents: You should route your DNS through the VPN too otherwise you'll be looking up hostnames and such through your normal connection and thereby leak data. Customizing where DNS requests go is also possible but now that's really nasty.

Paula

Maybe a crazy though, dunno, but what about settin up virtualbox inside my Linux VPS to run a virtual linux instance which has PIA configured, would that work? In theory, I can still access my VPN, while the VM is happily downloading torrents via VPN.

mksh

@Paula said:
Maybe a crazy though, dunno, but what about settin up virtualbox inside my Linux VPS to run a virtual linux instance which has PIA configured, would that work? In theory, I can still access my VPN, while the VM is happily downloading torrents via VPN.

If your VPS can take the overhead of nested virtualization that should work just fine. You could also try to save a bit of resources by avoiding the desktop environment on the host VPS and run qemu with vnc (through ssh tunnel obviously but that's fairly easy) on the commandline instead of virtualbox.

mikewazar

Or just use their SOCKS proxy instead...

mksh

@mikewazar said:
Or just use their SOCKS proxy instead...

Does SOCKS work for UDP or can you torrent over TCP?

mikewazar

Torrents are TCP by nature... SOCKS can do both UDP and TCP.

mksh

@mikewazar said:
Torrents are TCP by nature... SOCKS can do both UDP and TCP.

Interesting. Didn't know the first and wasn't sure about the second.

c0de

@Paula said:
Is there a way to allow VNC connections to my VPS while still having Private Internet Access in place? It seems that once OpenVPN/PIA is running, I can no longer connect to my VPS since it routes all traffic via PIA.
I am using Ubuntu 16.04 with Lubuntu GUI.

Thanks for any help!

A suggestion for regaining access to your server would be to use your provider's "emergency console" if they provide one.

If you are using the PIA app, you have to also have the "enable portforwarding" option turned on