I hope this is the right place to ask this. I’m just not much experienced with MikroTik devices (and network stuff in general).
I have a MikroTik RB951Ui-2HnD router which I’m currently using it as an Internet Access Point. I also have a VPN account bought from ExpressVPN and I’m planning to set it up directly on the router so any device connected to the router/access point can use VPN without needng the mobile apps or any other client-side configuration. I also hope to be able to enable split-tunneling for the VPN connection so that certain websites/applications go through VPN and others don’t.
But as I said I’m a total noob with these things. Even the person who configured the router to be an access point wasn’t me. So I hope someone will favor me by telling me a way to do this and I kindly ask for your help with this issue if possible.
Thank you in advance.
P.S. I actually posted this on reddit too, but still I couldn’t manage it to work.
P.P.S I also checked the following links but didn’t a find way to do this:
You should first decide which VPN protocol you want to use.
After a quick tour on ExpressVPN they (at least) support OpenVPN, L2TP/IPSec and IKE2.
OpenVPN is the easiest one to use and setup. It may be also the slowest.
L2TP/IPSec is easy to setup too.
IKE2 is harder to setup on mikrotik.
Details:
The OpenVPN implementation on Mikrotik doesn’t support neither LZO-Compression nor UDP. If you want to use it, you have to find out if ExpressVPN forces you to use one of these technologies. If so, you can’t use ExpressVPN with Mikrotik.
L2TP/IPSec is a easy to setup and maybe a little faster VPN protocol. Due to the design of IPSec ExpressVPN forces you to use a very easy to guess Pre-Shared-Key. In my opinion if you use this key you are hiding your IP-Address and location from the servers you contact through that VPN tunnel. But if someone wants to decrypt your traffic going thru the tunnel, it is easy to do so.
IKE2 is fast and it is also a IPSec protocol. however the downsites with a weak pre-shared-key are the same as for L2TP/IPSec.
In my opinion you should try to find out if ExpressVPN OpenVPN is compatible with Mikrotik. (About LZO-Compression and UDP).
If thats true, I would go for OpenVPN. If your traffic is not much confidential, maybe L2TP/IPSec is the better way to go because it should just work and is as easy to setup as OpenVPN.
The first link you gave in your post from techshield.com is not any usefull. The setup described there is completely different and not related to ExpressVPN in any way.
The second link is very helpfull and that should be the way to go.
So try removing the setup you did before and start from scratch. (Using the second link) The way to setup a VPN for OpenVPN and L2TP/IPsec is very similar.
If OpenVPN is the slowest one I’ll go with either L2TP or IKEv2 because like you said confidentiality isn’t of much concern for me. I only use VPN to access Geo-blocked content so the main concern (aside from the speed) is persistence in censorship circumvention. I tried some other VPN providers like NordVPN and Surfshark but unfortunately they didn’t worked for me(didn’t had good speeds or didn’t connect at all).
About ExpressVPN’s compatibility with MikroTik, I talked with ExpressVPN’s support but they said MikroTik isn’t among their supported routers, so they can’t provide guidance on it.
As you said I did reset configurations on the router and used the guide in the second link and tried to change some configurations to make it match with ExpressVPN’s configurations, but again couldn’t make it work(i.e blocked websites are still blocked).
The L2TP interface is running (R-flag) so the tunnel is working.
The only problem I see is that the route is disabled wich route the marked packets to the tunnel. Try to enable this route (the first one). It should work after that.
When I enable that route my connection to almost all the internet is lost, that is I can’t open any websites (except “google.com” which I don’t know why).
Ok. I don’t have experience with routing marked packets over a VPN.
Can you provide a little more details?
Which version of RouterOS are you running?
Please also post the output of “/export hide-sensitive”. Make shure to hide sensitive content.
Can you change src-address to “src-address=192.168.88.2-192.168.88.255”
This way the address of the router gets excluded. But I don’t think that makes any difference.
And in “/ppp profile” can you set “change-tcp-mss” to yes in “default-encryption” ?
Alternatively you can copy “default encryption” profile and set change-tcp-mss to yes in the copied profile.
Since I’m not much experienced with the terminal, I tried to do what you said through the WebFig interface.
Did it from here but as you predicted nothing observable has changed.
I think the “Change TCP MSS” parameter is already set to “Yes”. See the following screenshot.
Disabled the Filter rule with the “Fasttrack connection” action but again nothing sensible happens.
And actually after each change I tried disabling and re-enabling this route (the greyed one) but anytime I enabled the route, my internet connection went down again.
This is the result of a ping and a tracert when the route was disabled:
C:\WINDOWS\system32>ping google.com
Pinging google.com [216.58.209.142] with 32 bytes of data:
Reply from 216.58.209.142: bytes=32 time=61ms TTL=52
Reply from 216.58.209.142: bytes=32 time=53ms TTL=52
Reply from 216.58.209.142: bytes=32 time=63ms TTL=52
Reply from 216.58.209.142: bytes=32 time=60ms TTL=52
Ping statistics for 216.58.209.142:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 53ms, Maximum = 63ms, Average = 59ms
C:\WINDOWS\system32>tracert google.com
Tracing route to google.com [216.58.209.142]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms router.lan [192.168.88.1]
2 1 ms 1 ms 1 ms 192.168.0.xxx
3 246 ms 230 ms 266 ms 172.20.2.xxx
4 39 ms 37 ms 38 ms 172.20.2.xxx
5 36 ms 16 ms 39 ms 172.20.40.xxx
6 43 ms 17 ms 41 ms 172.17.2.xxx
7 33 ms 31 ms 38 ms 10.202.6.xxx
8 41 ms 30 ms 40 ms 10.201.47.xxx
9 31 ms 35 ms 38 ms 10.21.0.xxx
10 35 ms 39 ms 34 ms 10.21.21.xxx
11 55 ms 60 ms 55 ms 213.202.4.xxx
12 78 ms 99 ms 90 ms 213.202.5.xxx
13 61 ms 73 ms 72 ms 216.239.48.xxx
14 68 ms 65 ms 60 ms 108.170.227.xxx
15 71 ms 68 ms 69 ms mct01s13-in-f14.1e100.net [216.58.209.142]
Trace complete.
This is the result of a ping and a tracert when the route was enabled:
So the tunnel seems to fail. Which is a little confusing to me beacuse the L2TP interface has the “running” flag in your pictures. But maybe this is “usual” for RouterOS.
It could also be a firewall or routing problem. But I couldn’t found a problem in your config.
But I read your config again and I found somthing regarding the L2TP interface:
There is configured “use-ipsec=yes” which is correct. but i am missing the “ipsec-secret”. Did you hide it or is there none configured? If there is none, please add it. You can found the ipsec-secret (also known as pre-shared-secret or psk) on the ExpressVPN website.
Also I can see “user=***” is configured but i can’t find a corresponding password configured. If the password is missing, please add it. You should use the password to the corresponding “user” for ExpressVPN.
After adding the two things, please try pinging again.
I disabled it through the IP>DHCP Server path in the WebFig interface(the above screenshot) but nothing was changed. However I’m not sure if this was the correct way to do this because after disabling it I ran the “/export” command and this line was still present:
/interface l2tp-server server
set use-ipsec=yes
Although the “enabled=yes” part isn’t there anymore but whether I keep DHCP Server enabled or not (by using the above way), the “enabled=yes” parameter doesn’t appear.
i wan to set ovpn client on mikrotik but i understand that mikrotik cant support udp and user auth and comp-lzo !
so i try to find slotion for ikev2(with remote id) and ipsec(with pre key)
but again i cant settup on my mikrotik
(i setup pptp and l2tp and they work fine but i think it is very slow on mikrotik, becuse when i set it on pc or device i get very good download upload and ping, but in mikrotik it act like turtle
i ned to wait 2 min just for a iplocation site)
can some one help me to setup ikev2 and ipsec client on mikrotik?
thanks a lot
