Three machines are involved here:
- My personal laptop
A, connected to the local network (green).
- The server
S that routes traffic between the local network and the OpenVPN subnet, on which bandwhich is running.
S has two addresses - a local network address Slocal and an OpenVPN subnet address Svpn.
- A remote client machine
B connected to the OpenVPN subnet (cyan).
B has two addresses - a public address Bpub and an OpenVPN subnet address Bvpn.

Here I am initiating a file transfer on A using scp from A to Bvpn, so on layer 4 the connection should be from A:56994 to Bvpn:22.
But bandwhich seems to believe that it's from A:56994 to Slocal:22 instead, and by extension believes that this traffic should be attributed to the local sshd process.
I think I've got some clues on what's wrong. Help welcomed nonetheless.
Three machines are involved here:
A, connected to the local network (green).Sthat routes traffic between the local network and the OpenVPN subnet, on whichbandwhichis running.Shas two addresses - a local network addressSlocaland an OpenVPN subnet addressSvpn.Bconnected to the OpenVPN subnet (cyan).Bhas two addresses - a public addressBpuband an OpenVPN subnet addressBvpn.Here I am initiating a file transfer on
AusingscpfromAtoBvpn, so on layer 4 the connection should be fromA:56994toBvpn:22.But
bandwhichseems to believe that it's fromA:56994toSlocal:22instead, and by extension believes that this traffic should be attributed to the localsshdprocess.I think I've got some clues on what's wrong. Help welcomed nonetheless.