NordVPN (IPSEC/IKEv2) + killswitch (For ROS6)

[lenart]

Hi,

Try to move below rules to the top and try again. Kill NordVPN IPSEC connection, clear conntrack list and try again.

add action=mark-connection chain=prerouting comment="Mark NordVPN IPSec traffic" connection-mark=!ipsec dst-address-list=!localnet,ipsec-remote new-connection-mark=NordVPN passthrough=yes src-address-list=NordVPN
add action=change-mss chain=forward connection-mark=NordVPN new-mss=64 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=!0-64

also those rules seem a bit odd to me. Why MSS 0-64? Or like “connection-mark=!ipsec”. I am not sure since your configuration has quite a lot of customization and it’s hard to say from your rules.

Also try to get rid of killswitch implementation for testing. For testing I like wtfismyip.com website as it shows your public IP which will change when you start using NordVPN.

Thanks, I’ve just tried that but it didn’t work as expected. The MTU clamping is set to 64 cos that was the packet size that did not show up as corrupted in the Mikrotik ping tool. It is for testing purposes and should work well enough for ping messages.

I got rid of the ‘connection-mark=ipsec’ rules just to make sure that it didn’t make a difference but that did not help either.

I have the sense that this is a firewall issue so your suggestion strengthens my suspicion. I think it would be best to redesign the firewall rules offline, clear the current ones and load the new set. Any tips on what diagnostics I can perform?