When a VPN client starts on an Ubuntu EC2 instance, it often redirects all traffic through the tunnel, including the SSH session. This causes immediate disconnection because the default gateway is replaced by the VPN provider's server, which is not reachable from your local machine. The solution involves configuring split tunneling or adding static routes to keep management traffic outside the VPN.
Understanding the Routing Conflict
The core issue lies in how Linux handles network routing tables. By default, most consumer-grade VPN clients are configured to route 0.0.0.0/0 (all internet traffic) through the new virtual network interface created by the VPN software. When this happens, the system forgets how to reach the AWS metadata service and your local ISP's DNS servers because those paths were previously handled by the primary elastic network interface (ENI).
This behavior is intentional for privacy on desktop systems but disastrous for headless servers. Once the default route points to the VPN gateway, any packet sent to your public IP address via SSH is directed into the tunnel. Since the VPN server cannot route packets back to your home IP directly without proper NAT traversal or port forwarding, the connection hangs and eventually times out.
Identifying the Changed Routes
You can verify this behavior by checking the routing table before and after connecting. If you have access to the console via AWS Systems Manager Session Manager, run ip route show. You will likely see a new line starting with default via [VPN-Gateway-IP] that supersedes the original AWS default route. The metric of the new route is usually lower, indicating higher priority.
This shift effectively isolates the server from the public internet except through the VPN endpoint. For a remote administration task, this is a fatal configuration error. Understanding how Ubuntu server network interfaces work is crucial here, as you need to distinguish between the physical ENI and the virtual tun/tap device created by the VPN.
Solution 1: Using Split Tunneling
The most robust fix is to configure the VPN client to use split tunneling. This method ensures that only specific traffic intended for the private network goes through the VPN, while all other traffic, including SSH and package updates, remains on the standard AWS route.
- Open your VPN configuration: Most VPN providers use OpenVPN or WireGuard. Locate the configuration file, typically ending in
.ovpnor.conf. - Add or modify the route options: Look for the
redirect-gateway def1 bypass-dnsdirective. This is the command responsible for hijacking your default route. Comment it out by adding a#at the beginning of the line. - Specify explicit routes: Instead of redirecting all traffic, specify only the networks you need to access. For example, if you want to access a corporate network at
10.0.0.0/24, addroute 10.0.0.0 255.255.255.0to the config.
If you are using a graphical VPN manager like NetworkManager, look for the "IPv4" settings tab. Ensure that "Use this connection only for resources on its network" is selected, rather than "Default route." This prevents the client from altering the system-wide default gateway.
Solution 2: Static Routes and Policy Routing
You can create a separate routing table for SSH traffic. First, assign a unique table ID, such as 100, in /etc/iproute2/rt_tables. Then, define a rule that sends traffic originating from your local IP (or destined for your management subnet) to this new table. In that table, set the default gateway to the AWS ENI gateway, not the VPN gateway.
# Example snippet for policy routing
# Add to /etc/iproute2/rt_tables
100 ssh-table
# Create rules in your startup script
ip rule add from [Your-Local-IP] table 100
ip route add default via [AWS-ENI-Gateway] dev eth0 table 100This approach is fragile because it relies on knowing your local IP address, which may change. It is generally safer to stick to split tunneling unless you are managing a highly specialized environment.
Preventing Future Disconnections
To avoid losing access again, consider using AWS Systems Manager Session Manager. This tool allows you to connect to your EC2 instance via the AWS SSM agent over port 443, bypassing the need for open SSH ports entirely. Since SSM traffic is routed through the AWS internal infrastructure, it is less likely to be affected by external VPN routing changes, although you should still ensure your VPN does not block outbound HTTPS traffic.
Additionally, always test your VPN configuration locally before applying it to production servers. Use a staging instance to verify that the default route is preserved or correctly overridden. Remember that changing network configurations on a live server carries significant risk. If you frequently encounter connectivity issues, reviewing common Ubuntu 22.04 VM internet connection issues might provide further insights into network stack behaviors.
Frequently Asked Questions
Why does my SSH session drop immediately when I start the VPN?
Your SSH session drops because the VPN client replaces the default gateway, sending your incoming SSH packets into the tunnel where they cannot be routed back to your local machine. The server no longer knows how to communicate with your public IP address directly.
Can I use WireGuard instead of OpenVPN to avoid this issue?
WireGuard itself does not solve the problem automatically; it also requires manual configuration to avoid hijacking the default route. However, WireGuard configs are simpler, making it easier to exclude specific subnets from the tunnel compared to some OpenVPN setups.
What is the safest way to manage an EC2 instance if I must use a VPN?
The safest method is to use AWS Systems Manager Session Manager, which connects via the SSM agent over HTTPS without requiring inbound SSH ports. This ensures you retain access even if your VPN alters the routing table incorrectly.
How do I check if my VPN is overriding my default route?
Run the command ip route show default in your terminal. If the output shows a gateway IP that matches your VPN provider's server rather than your AWS instance's primary gateway, the override has occurred.
Is it possible to restore connection after being locked out?
Yes, you can use the AWS EC2 Serial Console or Systems Manager Session Manager to regain access. These tools operate independently of the network interface routing table, allowing you to edit VPN configurations or disable the service remotely.