I’m very new to Microtik and trying to get a NordVPN connection up and running on my Hex following Nord’s own tutorial on the subject. I have the following config:
The tunnel comes up successfully with the two SAs, and the firewall rule gets added as expected. But I end up with no internet connectivity from anywhere in the LAN. I’m guessing there’s some interaction with the PPPoE settings but I’m really a bit of a networking novice
Hmm, this is less clear-cut than I realised. If I configure the ipsec mode-config to point to an address list with a single address (my test machine on the LAN), then all other machines on the LAN can access the internet fine, but from the test machine I can no longer load any web pages. However, it turns out that I can still ping 8.8.8.8, and more interestingly, I can still do
dig @8.8.8.8 www.yahoo.com
just fine. If I set the address list of the mode-config to be the LAN address range (192.168.1.0/24) then no machines on the local network can load stuff on the internet, but everything can still ping and do DNS lookups.
from the router just fine even when I have the full LAN address range configured to go through the ipsec tunnel.
I don’t know if it makes a difference (it shouldn’t, I don’t think) but my ISP is double-NATing me. The Microtik router is connecting via PPPoE. It feels like there’s just some daft routing/firewall interaction going on but my networking-fu is too weak to see what it is.
One possibly connected thing: my router appears to have several addresses as a function of the PPPoE setup. Here’s the routing table without any VPN enabled:
0 ;;; defconf
192.168.1.1/24 192.168.1.0 bridge
1 D 92.119.74.178/32 192.168.207.1 pppoe-out1
2 D 10.6.0.7/32 10.6.0.7 pppoe-out1
It’s not clear to me how i have a public address of 92.119.74.178 attached to a private network block (192.168.207.1). I have no idea what the 10.6.0.7 address is about. I can’t ping or traceroute that. It doesn’t seem to affect anything.
Local machines can talk to the router just fine - I can access the web interface and resolve DNS against the router’s DNS server.
Here’s the output of “/ip ipsec policy print” once the ipsec is established:
# PEER TUNNEL SRC-ADDRESS DST-ADDRESS PROTOCOL ACTION LEVEL PH2-COUNT
0 T * ::/0 ::/0 all
1 T 0.0.0.0/0 0.0.0.0/0 all
2 DA NordVPN-uk2216 yes 10.6.0.7/32 0.0.0.0/0 all encrypt unique 1
and here’s “/ip firewall nat print”
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; ipsec mode-config
chain=srcnat action=src-nat to-addresses=10.6.0.7 src-address-list=local dst-address-list=!local
1 ;;; defconf: masquerade
chain=srcnat action=masquerade src-address=!192.168.1.0/24 out-interface-list=WAN log=no log-prefix="" ipsec-policy=out,none
2 chain=srcnat action=masquerade out-interface-list=WAN
In case it’s relevant, here’s “/interface list member print detail”:
Hmm, yeah, that does seem wrong now that I look it again. The one that looks wrong to me is actually the 2nd one - because it has a “!” at the front, which doesn’t make sense to me. I have updated them and now I have this:
It still works correctly without the ipsec enabled (in which case obviously the first NAT rule above disappears), but sadly it still doesn’t work with ipsec enabled
The other thing that seemed a bit odd was the fact that both ether1 and pppoe-out1 were part of interface-list “WAN” which seems a bit misleading given that the default masquerade NAT rule references this as out-interface-list. So I changed that to only include pppoe-out1 but I don’t think it made any difference.
One final thing that seems odd to me but might be just a misunderstanding about how this is supposed to work: when I list the active peers, the nordvpn server appears as expected, but the “dynamic address” field is empty. I would have expected this to contain the same 10.6.0.7 address that is assigned by the responder and which appears in the ipsec policy and the dynamically generated firewall NAT rule. Could this be the problem?
Could it be an MTU issue? Can you play with the ping tool using the do-not-fragment flag to discover the largest MTU that cat reach 8.8.8.8 from the work-marchine after IPsec tunnel is up?
Here is a discussion of the issue with NordVPN in more detail, specifically replies by @sindy toward the end.
Interesting! Without the tunnel I can send packets of 1450 (1478 with the frame); if I go over that it tells me the message is too long. With the tunnel enabled, the maximum I can send is 1370 (1398). If I go over that, it doesn’t give me an error, but I get no response back (100% packet loss). So maybe this is an MTU issue like you say. I will have a read through that thread and try the suggested solution
Now it all works, which is great. I get the Nord server public ip address from all my LAN machines. Sadly, i’m still getting geo-blocked by some of the services that I’d hoped to use. This is frustrating because using the native nordvpn client to setup a tunnel on an individual machine works fine with these services. Ah. I do appear to have a DNS leak. I have google DNS servers showing up Thanks for all the help so far!
