How to wrap all traffic in the tunnel, except for 1 port?

Question

linux

I installed OpenVPN on the VPS and wrapped all traffic in a tunnel to get a white IP.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp -d xxx.xxx.xxx.xxx -j DNAT --to 10.8.0.2

But ssh also went there. How to form a rule so that ssh stays on host xxx.xxx.xxx.xxx?

Answer 1

Use ! to allocate an ssh port, similar to what you did for the subnet in destination.