Accessing remotly Server While Using VPN on Asus Router with Merlin Firmware

[psimaker]

Hello everyone,

I’m facing an issue with my Asus router (Model: BE88U running Merlin firmware (version: [3006.102.2]). I’ve configured a Mullvad VPN connection through OpenVPN (tried wireguard also) to route all my network traffic through the VPN. However, I need to access remotely my home server, while keeping the rest of the server’s traffic routed through the VPN.

Setup and Goal:

• My home server’s local IP is 192.168.8.112.
• I want to access ports 22, 80, 443, and 32400
• All traffic should go through the VPN.

What I’ve Tried So Far:

1. I set up policy-based routing rules to attempt to route.
2. I also configured port forwarding for these ports, intending to make them accessible externally via the WAN IP while the VPN connection is active.

Any ideas how I could reach that? On my old Glinet router, I had no issues.

Thanks in advance for any help!

 

[eibgrad]

Any device bound to the VPN is NOT accessible over the WAN because of reverse-path filtering, which requires inbound traffic (such as that coming from remote access) to exit through the same network interface. IOW, you can't create a situation of WAN in/VPN out, or vice versa. It has to be WAN in/WAN out, or VPN in/VPN out.

One obvious way to work around the issue is to always access devices bound to the VPN, over the VPN rather than the WAN, provided your VPN provider allows it (most do NOT).

Another is to create static routes that bind the incoming source IP from remote access over the WAN, to the WAN, but that assumes you have the ability to KNOW ahead of time what those source IPs are likely to be (workplace, school, local wifi cafe, etc.).

At least those are the relatively easy solutions.

Another possibility is binding the app/service that's the target of remote access over the WAN to a secondary IP network (aka, multihoming), along w/ the router, thus isolating that particular app/service from the VPN, even though everything else on the target device is still bound to the VPN. Needless to say, it's a bit more complicated to configure.

I've also seen some ppl create a guest VM for the specific app(s) they wanted routed over the WAN. This works because the host and guest VM are typically using different source IPs, and can thus be managed independently wrt the VPN Director.

It's also theoretically possible to implement your own PBR (policy based routing) rather than depend on the VPN Director, one which is more finely-grained and similarly directs traffic either over the WAN or VPN based on other criteria and NOT just the source IP (e.g., source port).