3

I cannot connect to my Mac via SSH when I run a VPN client on it. When I connect to the public IP address of my Mac, the return packets are being routed over the VPN. I need to force these packets to be routed over the public interface.

This question has been answered for Linux here: https://serverfault.com/questions/659955/allowing-ssh-on-a-server-with-an-active-openvpn-client/918441#918441. Unfortunately the solutions provided do not apply for macOS Big Sur as ip is not available.

I am using the official PIA VPN client in WireGuard mode.

How can I connect to my Mac via SSH while it is connected to the VPN?

Improve this question

2 Answers 2

Reset to default
3

If this works when the VPN software is disconnected, then you now have a case to make a configuration change on the VPN server to allow split tunneling.

By default, many VPN servers demand and check that all traffic to the Mac (or PC or Android or iOS or unix client) connect only through the VPN. This causes intentional breakage of ssh since its can no longer listen for an incoming connection from your local subnetwork.

Signing in to a single tunnel VPN intentionally breaks the interface since it exists on the other end of the network tunnel which is a different network range. This is a security issue as most companies consider VPN a firewall to prevent any communications as you have described. This is working as intended for many VPN setups and what you ask may break or be contrary to security setup decision.

Options to change this include:

  1. Try to establish your ssh session before VPN tunnels engage.
  2. Change the nature of your VPN tunneling configuration to allow split tunneling.
  3. Use a network to network VPN tunnel instead of a client to network tunnel.

It’s a good idea to review your security policy if someone else imposes VPN since this could be outside their design parameters or violate security policy if split tunneling is intentionally disabled.

Improve this answer
4
  • Thank you, bmike, that's good advice. My only option is split tunneling but the client provided by PIA only allows for application bundles to be added to the list of applications exempt from VPN. I suppose that if I could add the sshd binary I could make things work.
    – C. Ocoa
    Mar 13, 2021 at 14:23
  • Boo @C.Ocoa and yay. I have few clients that even get the App exception instead of a hard no and 👀 from Security (or IT). If you wanted to ask a follow up software recommendation of any app that works to listen for ssh and pass it off, I wonder if someone has a solution for you.
    – bmike ♦
    Mar 13, 2021 at 14:43
  • I just did that: apple.stackexchange.com/questions/415721/…
    – C. Ocoa
    Mar 14, 2021 at 8:30
  • Thank you @C.Ocoa I was thinking you would ask which app can make ssh work with your current VPN client but I suppose you could ask for the opposite.
    – bmike ♦
    Mar 14, 2021 at 9:51
0

I have been unable to find a software solution. I solved the issue opening a port on my router to my NAS. There I run a SSH tunnel to my Mac. Now I can run a VPN client on my Mac while connecting to it from outside via SSH.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .