I configured my CRS309-1G-8S+ (RouterOS 7.20.6) with two VLANs:
VLAN1 plain switch mode, connected to an external router (via sfp-sfpplus1)
VLAN30 connected to the same external router (via sfp-sfpplus2), but configured in router mode (double NAT configuration).
I have a working NordVPN IKEv2 setup: I can activate ipsec peers selectively (e.g. I activate NordVPN_jp for connecting to a server in Japan), and route all traffic of a given local machine through VPN by adding its address to the corresponding firewall address list (i.e. nordvpn_jp_list): see full configuration below.
My Windows PC connected to VLAN30 (via sfp-sfpplus3, IP 192.168.30.100) works perfectly at full 1Gbit/s. But when NordVPN IKEv2 activates for use to/from this PC, speedtest drops to very slow speeds (too slow to explain by VPN overhead alone) and general web connectivity become very slow, while router CPU stays <1%.
Do you see any issue in my config? Any fixes or suggestions to have VPN work properly?
You use a switch as a router. That is the problem.
It has no support for encryption so all encrypting is done by CPU and that kills your switch.
CRS have ability to route but it's rather intended for occasional management usage, not for full scale service.
Even if the CRS309 has a slow CPU for routing and VPN, it's not that slow that you cannot browse websites while the CPU load is under 1%.
You are combining IPsec with fasttrack, that's the cause of your problem. They are not compatible. Please note that in the firewall that MikroTIk ship with their defconf configuration for home routers, the fasttrack rule is preceded by two rules:
The two accept rules make sure the fasttrack rule cannot catch packets with the two specific ipsec-policy. Try to add those two rules before your fasttrack rule.
Also, the masquerade NAT rule also have special condition related to IPsec:
Indeed these rules help, even if the second one (add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec) is never hit and shows 0 stats.
Disabling fasttrack completely improves connection even more. So probably the rules do not prevent completely fasttrack from interacting with IPSEC.
Even with fasttrack disabled I think I am still missing something, because connectivity through VPN is not quite smooth yet:
Speedtest download is around 40Mbps, not saturating CPU.
Speedtest upload is intermittent at beginning, takes some seconds to stabilize and reach a decent bandwidth after a few seconds.
The "accept out ipsec policy" rule still shows 0 hits
Internet browsing through VPN is smoother than before (I even managed to watch videos on Youtube Japan), but still some sites take forever to load.
In many cases the site shows up fast but "site loading" indicator continues to spin for long time.
I tried to connect my smart TV through VPN too, but it most streaming apps do not even load, showing connectivity errors.
Below you can see a simplified config (no VLAN, router only).
What could still be missing?
Would it be possible to send me the full default Mikrotik "home router" configuration?
You might not get higher throughput than that number with the dual core 800MHz CPU of the CRS that has no IPsec hardware acceleration. For reference, the old hEX RB750Gr3 with dual core 880MHz CPU and IPsec hardware acceleration available can only do 135Mbps in MikroTik published ideal numbers.
With the CPU having no IPsec hardware acceleration, it might be better to switch to WireGuard for better performance.
As for the issue with some sites taking forever to load or your smart TV, it's most probably a MTU issue. You might need to add a mangle rule to reduce the MSS for the TCP connection, something like:
If you switch to WireGuard, then you'll also need the two change-mss rule, but replace the ipsec-policy condition with in-interface=wg1 and out-interface=wg1 (with wg1 being the name of the WireGuard interface) and the MSS ceiling is 1380 instead of 1382.
It's the difference between home routers and advanced ones.
The home ones can satify 99% of your needs with default settings but the advanced 1% is unaccesible as it is assumed to be unnecessary for home user.
The advanced routers do 1% of your needs at the start but the 99% is accesible when you need it, however it needs a lot of training to set it up properly.
