NordVPN IPSEC (IKE2)

RouterOS Beginner Basics
1

Hi,

I want to have the traffic of all devices connected to a certain ethernet port routed over my NordVPN. The first thing I did was to set up the connection according to the guide: https://wiki.mikrotik.com/wiki/IKEv2_EAP_between_NordVPN_and_RouterOS

But as I want all traffic connected to a certain port (regardless of the LAN IP) I did the following:

  • create a bridge
  • assign an ethernet port to that bridge
  • add a DHCP server/pool/network to that bridge (192.x.x.x/24)
  • add a Mangle rule:
    chain: prerouting
    src-address: 192.x.x.x/24
    action: mark-connection
    connection-mark: nordvpn-mark

So it should work right? Traffic seems to be going to NordVPN, a check of my external IP confirms that. However when I do a speedtest the upload test will “hang” at 0.0mbps. I tried several, none seem to work. On my own server I have a simple PHP “upload file” script, tried to upload a file but after a wile I get a 408 - timeout. It looks like I cannot send traffic over the VPN connection? But then again I can ping addresses and I can use the internet (seems to be slow even though my download is ~100mbps over VPN).

I think I am missing something here, does anybody perhaps have done the same I’m trying to get to work? Please let me know if uploads work for you!

2

http://forum.mikrotik.com/t/nordvpn-ikev2-connected-but-no-internet/137126/1

3

Both accepting ICMP (already done in my case) and changing the MTU had no effect. However I experimented a bit more and I found out that when a added 2 firewall rules it suddenly worked.
Chain: forward
Action: accept
src-address: 192.x.x.x/24
and another rule with
src-address 192.x.x.x/24

So there must be somekind of rule in my firewall config that blocks traffic now all I need to do is find that rule :wink:

4

You have to choose one of the options and not both.