At present I have Gargoyle setup on my WNDR3700 to connection to a VPN provider in order to provide a little privacy. However this prevents me from connecting remotely to my home network. Previously I used several methods used over time: ssh into a LAN host, LAN host providing OpenVPN service, router acting as an OpenVPN server.

The question I have is:
Is it possible to route traffic you'd want privacy maintained upon (most comms) through the external VPN provider whilst still allowing remote connections onto the network? In an ideal world I'd want all traffic going onto the internet to pass through the external VPN but be able to VPN from external (Tablet, Phone, Work) back to my LAN to access resources, maintain and monitor.

My initial thoughts are that the WNDR3700 cannot do this as, if it maintains the client connection to the external VPN, it cannot then listen on the normal WAN IP address for ssh or OpenVPN traffic or pass it through. But by the router not maintaining the VPN link I am then open to traffic sneaking out unprotected onto the internet.

My networking knowledge is basic beyond flashing the firmware and passing through ports etc. so there may well be some networking magic that allows this to happen on the one device.

  • One thing does not exclude the other as long you have iptables rules excluding the intended connections from trying to leave through the VPN Feb 17, 2016 at 12:08
  • Ok. My issue still remains, as a non-expert network person, how do I setup the router to act as an OpenVPN client and yet still allow connections from external to connect to the LAN? I'm thinking I'd either need to port forward external SSH or OpenVPN to an internal host with a VPN connection from external being preferable. It is unclear to me in the front end or ssh to router how to actually set this up.
    – Mark
    Feb 17, 2016 at 22:47
  • Unfortunately I cannot help you with the specific steps, as while I have an OpenWRT, I only use it for wifi, and use a router on front of it for the heavy duty work of VPN for inside/going out. I have been lazy in setting up a scenario of going out via VPN, and going in my network as you describe, but should be a matter of days now. What I can answer to your question, yes, it works via a single point. I am going in via "Cisco" IPsec in OS/X and iPhone clients , and in a few days will also go out via VPN. At the end of the day, the exceptions are the most difficult, like the ISP voIP server. Feb 18, 2016 at 7:40
  • Doesn't allow Gargoyle for custom firewall ports? Maybe you should ask this question in their support forum. Some VPN providers allow for port forwarding as well. Which VPN provider are you using?
    – user258572
    Feb 6, 2018 at 20:17


You must log in to answer this question.

Browse other questions tagged .