i have read but i don’t understand much about networking, i am a simple consumer who uses the mikrotik sxt modem outside. i tried to configure surfshark vpn as per guide. but once connected to the vpnthe connection has slowed down. now i installed the developement version on the router and for now everything works fine.
The titile stated that the connection are killed because of the short TTL of the DNS resolve. You have problem that your VPN connection is slowing down and that is a different problem.
Might be being slow on a Sunday, but why is there a difference between the new MSS of 1360 and 1453 for the old MSS?
Where have you been all this time? 
Any feedback with the latest beta version? The issue should be resolved there.
hello, does this change solve the problem?Thank you
No when I look at the subject of this thread. There is a workaround wich can be used till the fix by Mikrotik trickels down to the other versions.
The topic linked to is tackling a different problem of ROS not able return a icmp 3-4 to the correct client when using IKEv2.
I installed version 6.48beta 40, and the connection is stable, there are some slowdowns and blocking of the navigation but I can’t understand why, I don’t understand much about this os and networking. maybe it was better to buy a router for ordinary people. now I just have to tinker and try.
I wanted to ask what these errors are: out-state-mode-errors: 692
in-errors: 0
in-buffer-errors: 0
in-header-errors: 0
in-no-states: 0
in-state-protocol-errors: 0
in-state-mode-errors: 0
in-state-sequence-errors: 0
in-state-expired: 0
in-state-mismatches: 0
in-state-invalid: 0
in-template-mismatches: 0
in-no-policies: 0
in-policy-blocked: 0
in-policy-errors: 0
out-errors: 0
out-bundle-errors: 0
out-bundle-check-errors: 0
out-no-states: 0
out-state-protocol-errors: 0
out-state-mode-errors: 692
out-state-sequence-errors: 0
out-state-expired: 0
out-policy-blocked: 0
out-policy-dead: 0
out-policy-errors: 0
I accidentally deleted the fasttracking function from the IP Firewall settings, is it something you need or can I do less? thanks for the answers, sorry for my ignorance
“ordinary people” and IPsec do not fit together well regardless the router manufacturer. IPsec is very flexible in many aspects, and flexibility comes with complexity of setup.
It depends on the CPU power of your router and the bandwidth of your uplink. Fasttracking is a way to simplify the processing of the packets in the firewall, to spend less CPU per an average packet. So if /tool profile shows more than, say, 20 % CPU usage while a normal traffic load is experienced, putting that rule back may help a lot. But due to the order of actions in the firewall, fasttracking also prevents IPsec from working properly in particular setups, as it bypasses also matching of the packets by the IPsec policies’ traffic selectors. So to restrict fasttracking to non-IPsec traffic, you need the “action=accept ipsec-policy=in,ipsec” and “action=accept ipsec-policy=out,ipsec” rules before the action=fasttrack-connection connection-state=established,related one in chain=forward of /ip firewall filter. Without them, the non-IPsec traffic will be handled faster, but IPsec traffic will be handled much slower (because only one in many packets of the fasttracked connections is not fasttracked and thus can hit the policies’ traffic selectors and be delivered via the IPsec tunnel).
The only information is here, but it’s not really useful. So if the tunnel does work otherwise, these errors may be caused e.g. by slow establishment of the tunnel.
6.48beta40 works for me (eliminates ~5 second drop of surfshark peer connection)
Thanks!
Hi all,
I was having two problems relateds with surfshark and mikrotik:
1 - IPsec connection dropping every 5-20 seconds; Fixed it updating the OS firmware to 6.48beta40 version!
2 - After that, the performance was too slow and web pages doesn’t loading; Fixed it disabling the fasttracking command at firewall panel;
Testing at PC it’s looks good…web navigation, youtube videos, and all…at least now =) . Trying to use at Samsung Smart TV and LG Smart TV, I had some streaming problem that doesn’t allow to reproduce videos at youtube, netflix, amazon video or iptv services (spotify looks good, web browsing too)…I tried to use differents DNS (by DHCP server > network), 208.67.222.222 / 162.252.172.57 / 8.8.8.8 / blank…but nothing has changed…need some help, please!
# oct/11/2020 23:25:24 by RouterOS 6.48beta40
# software id = HGAG-UTY7
#
# model = RB750Gr3
/ip ipsec mode-config
add name=SSVPN responder=no src-address-list=local
/ip ipsec policy group
add name=SSVPN
/ip ipsec profile
add name=SSVPN
/ip ipsec peer
add address=us-ltm.prod.surfshark.com exchange-mode=ike2 name=SSVPN profile=\
SSVPN
/ip ipsec proposal
add name=SSVPN pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=\
162.252.172.57,149.154.159.92 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=192.168.88.0/24 list=local
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip ipsec identity
add auth-method=eap certificate=surfshark_ikev2.crt_0 disabled=yes \
eap-methods=eap-mschapv2 generate-policy=port-strict mode-config=SSVPN \
peer=SSVPN policy-template-group=SSVPN username=[my_username]
/ip ipsec policy
add dst-address=0.0.0.0/0 group=SSVPN proposal=SSVPN src-address=0.0.0.0/0 \
template=yes
/system package update
set channel=testing
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN