Just thought I'd post my config because I've seen this several different ways, some of which involved several ports or whitelisting massive chunks of Amazon IP Addresses.
I'll assume you have Plex setup as well as your OpenVPN on your router, and you will need to use a static IP for the Plex server or this will break on IP change.
Step 1. Setup Remote Access in Plex
I used a manual port for this, but as it stands this won't work over VPN (unless you have some VPN that handles port forwarding). As most people are bypassing the VPN, we'll use this.
Choose whatever manual port you want and take note of it. At this point the Remote Access is not going to work.
Step 2. Forward this port to your Plex Server.
Use the port from step one as both the Port Range and Local Port. Enable Forwarding for "BOTH". Call your service Plex (doesn't really matter about the name).
Step 3. Easy VPN Domain Bypass
OpenVPN can lookup the IP Addresses via domain. I simply added "route plex.tv 255.255.255.255 net_gateway" (no quotes) to custom configuration on the OpenVPN client page. This makes that domain bypass the VPN. We need this because the Remote Access will get your VPN IP which most likely will reject your port. This makes it see your real IP.
Step 4. Make traffic over the Plex port bypass the VPN.
This uses a method that let me use SSH over VPN, something I struggled to get working with an OpenVPN Desktop client (actually never did get working. VPN dead = no SSH). It works the same way for Plex.
I use this script for my OpenVPN event handler (openvpn-event).
That script works for me with 1 VPN (probably more than 1 as well). This will make all the Plex traffic going in and out of the port we chose not use the VPN. I only needed one port, and I didn't have to whitelist half of Amazon to make this work.
I tested this and I was able to access my Plex server via my iPhone on a different network, 25 miles away.
I'll assume you have Plex setup as well as your OpenVPN on your router, and you will need to use a static IP for the Plex server or this will break on IP change.
Step 1. Setup Remote Access in Plex
I used a manual port for this, but as it stands this won't work over VPN (unless you have some VPN that handles port forwarding). As most people are bypassing the VPN, we'll use this.
Choose whatever manual port you want and take note of it. At this point the Remote Access is not going to work.
Step 2. Forward this port to your Plex Server.
Use the port from step one as both the Port Range and Local Port. Enable Forwarding for "BOTH". Call your service Plex (doesn't really matter about the name).
Step 3. Easy VPN Domain Bypass
OpenVPN can lookup the IP Addresses via domain. I simply added "route plex.tv 255.255.255.255 net_gateway" (no quotes) to custom configuration on the OpenVPN client page. This makes that domain bypass the VPN. We need this because the Remote Access will get your VPN IP which most likely will reject your port. This makes it see your real IP.
Step 4. Make traffic over the Plex port bypass the VPN.
This uses a method that let me use SSH over VPN, something I struggled to get working with an OpenVPN Desktop client (actually never did get working. VPN dead = no SSH). It works the same way for Plex.
I use this script for my OpenVPN event handler (openvpn-event).
Code:
#!/bin/sh
# Setup FWMarks
WAN0=200
WAN1=201
VPN1=211
VPN2=212
VPN3=213
VPN4=214
VPN5=215
# Disable Reverse Path Filtering
sleep 10
for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do
echo 0 > $i
done
# Reset Primary WAN Routing Table
ip route flush table wan0
ip route del default table wan0
ip rule del fwmark $WAN0 table wan0
ip rule del fwmark $VPN1 table ovpnc1
ip rule del fwmark $VPN2 table ovpnc2
ip rule del fwmark $VPN3 table ovpnc3
ip rule del fwmark $VPN4 table ovpnc4
ip rule del fwmark $VPN5 table ovpnc5
ip route flush cache
iptables -t mangle -F PREROUTING
# Reset Primary WAN Routing Table Rules
#VPN_LIST="1 2 3 4 5"
VPN_LIST="1"
for VPNID in $VPN_LIST
do
# Copy IP Routing Rules
ip route show table main | grep -Ev ^default | grep -Ev tun1$VPNID | while read ROUTE;
do
ip route add table wan0 $ROUTE
done
# Set Active VPN State
VPN_STATE=$(nvram get "vpn_client"$VPNID"_state")
if [ $VPN_STATE -eq -1 ]
then
nvram set "vpn_client"$VPNID"_state"=2
fi
done
ip route add default table wan0 via $(nvram get wan0_gateway)
ip rule add fwmark $WAN0 table wan0
ip rule add fwmark $VPN1 table ovpnc1
ip rule add fwmark $VPN2 table ovpnc2
ip rule add fwmark $VPN3 table ovpnc3
ip rule add fwmark $VPN4 table ovpnc4
ip rule add fwmark $VPN5 table ovpnc5
ip route flush cache
# Plex Traffic: Bypass VPN
iptables -t mangle -C PREROUTING -i br0 -p tcp --sport 32400 -j MARK --set-mark $WAN0
if [ $? -eq 1 ]
then
iptables -t mangle -A PREROUTING -i br0 -p tcp --sport 32400 -j MARK --set-mark $WAN0
fi
iptables -t mangle -C PREROUTING -i br0 -p udp --sport 32400 -j MARK --set-mark $WAN0
if [ $? -eq 1 ]
iptables -t mangle -A PREROUTING -i br0 -p udp --sport 32400 -j MARK --set-mark $WAN0
then
fi
iptables -t mangle -C PREROUTING -i br0 -p tcp --dport 32400 -j MARK --set-mark $WAN0
if [ $? -eq 1 ]
then
iptables -t mangle -A PREROUTING -i br0 -p tcp --dport 32400 -j MARK --set-mark $WAN0
fi
iptables -t mangle -C PREROUTING -i br0 -p udp --dport 32400 -j MARK --set-mark $WAN0
if [ $? -eq 1 ]
then
iptables -t mangle -A PREROUTING -i br0 -p udp --dport 32400 -j MARK --set-mark $WAN0
fi
# SSH Traffic: Bypass VPN
iptables -t mangle -C PREROUTING -i br0 -p tcp --sport 22 -j MARK --set-mark $WAN0
if [ $? -eq 1 ]
then
iptables -t mangle -A PREROUTING -i br0 -p tcp --sport 22 -j MARK --set-mark $WAN0
fi
iptables -t mangle -C PREROUTING -i br0 -p udp --sport 22 -j MARK --set-mark $WAN0
if [ $? -eq 1 ]
iptables -t mangle -A PREROUTING -i br0 -p udp --sport 22 -j MARK --set-mark $WAN0
then
fi
iptables -t mangle -C PREROUTING -i br0 -p tcp --dport 22 -j MARK --set-mark $WAN0
if [ $? -eq 1 ]
then
iptables -t mangle -A PREROUTING -i br0 -p tcp --dport 22 -j MARK --set-mark $WAN0
fi
iptables -t mangle -C PREROUTING -i br0 -p udp --dport 22 -j MARK --set-mark $WAN0
if [ $? -eq 1 ]
then
iptables -t mangle -A PREROUTING -i br0 -p udp --dport 22 -j MARK --set-mark $WAN0
fiThat script works for me with 1 VPN (probably more than 1 as well). This will make all the Plex traffic going in and out of the port we chose not use the VPN. I only needed one port, and I didn't have to whitelist half of Amazon to make this work.
I tested this and I was able to access my Plex server via my iPhone on a different network, 25 miles away.
