Tip: username and password for NordVPN connection on router, is different than you using for log in their web page. Must use “Service credentials (manual setup)” from “https://my.nordaccount.com/pl/dashboard/nordvpn/”
I’ve updated few steps and done general cleanup.
I cannot get this to work, even with simple “add action=notrack chain=output protocol=ipsec-esp” bytes counter is just not increasing. What I am doing wrong? Regular rule above fasttrack works wonderfully tho…
The NordVPN server addresses need to be in that addresslist.
If you remove the need for the external addresses, the lines will notrack any IKEv2 traffic.
Hey everyone,
I have a similar setup:
- Where a list of ip address go through VPN only
- The rest go through WAN
but for some reason I made less steps to get same results, but it works (and no letters from provider so far)
I was wondering, what did I miss, and how dangerious is my setup
# add to list
/ip firewall address-list add address=192.168.88.8 list=vpn_p2p_users
# create profile
/ip ipsec policy group add name=NordVPN
/ip ipsec profile add name=NordVPN
/ip ipsec peer add address=us8657.nordvpn.com exchange-mode=ike2 name=us8657.nordvpn.com profile=NordVPN
/ip ipsec proposal add name=NordVPN pfs-group=none
/ip ipsec identity add auth-method=eap certificate="" eap-methods=eap-mschapv2 generate-policy=port-override mode-config=NordVPN username=your_service_login password=*** peer=us8657.nordvpn.com policy-template-group=NordVPN
/ip ipsec policy add dst-address=0.0.0.0/0 group=NordVPN proposal=NordVPN src-address=0.0.0.0/0 template=yes
/ip ipsec mode-config add name=NordVPN responder=no src-address-list=vpn_p2p_users
# killswitch
/ip firewall nat add action=return chain=srcnat src-address-list=vpn_p2p_users
Added this note to the main post:
Note 2: You might be able to route all traffic of the company, but you might end up routing 30-40% of the websites under NordVPN if company uses popular hosting, e.g. Amazon AWS or Linode. For example, Mikrotik.com resolves to “159.148.147.196”. Quick google revealed the Mikrotik has it’s own ASN which contains 512 ips, or in other words, If you wish to access Mikrotik services/websites under NordVPN, you should add 159.148.147.0/24 and 159.148.172.0/24 to your address list using this (2nd) method.
it works if you make longer distance on default route. sat
/ip dhcp-client
add default-route-distance=10 disabled=no interface=bridgeWAN
looks pretty nice, can anyone more profound check the way especially the kill switch?
The “kill-switch” uses a return which ends further processing by the lines that are underneath it in the NAT.
That traffic ends there if it can’t be routed in a other way. I prefer to tar-pit or route it to a non existing target (100.69.69.69).
Thanks for this great guide!
I set it up and it all works.
I chose the first option where ALL traffic is redirected through the VPN tunnel. But since my router is actually jus a part of a small LAN , I cannot reach the other local subnets anymore from the subnet where I configured the VPN connection (10.0.1.0/24).
I Already setup RIP for this. The Mikrotik router uses two bridges, one “untagged” an one with VLAN 50 which are trunked on one interface. The VPN connection is configured on the bridges with VLAN 50 in it.
I can reach all other subnets form the untagged bridge. Also, the VPN connection works fine over the VLAN 50 bridge. In the routing tables I can see all subnets routed. But since of course I configured to have all traffic go through the VPN tunnel, concluding these meant for the local subnets, the connection is now effectively gone.
My questions is: how can I pass ALL traffic through the tunnel, EXCEPT all traffic meant for 192.168.x.x?
I tried method #1 and it works very well.
I am having problems with making method #2 work thought.
After applying the commands as described, it still does not work.
Instead of showing me the country that the VPN is connected to, I get my home country.
Could it be that some detail was lost on one of the updates of the commands on the main post?
I did a diff between #1 and #2 and the only difference was the third command: firewall mange command on which had dst-* on #2 instead of src-* on #1.
Could this really be the only difference between the 2 methods?
Could this really be the only difference between the 2 methods?
Basically both methods are the same and works the same. Except the killswitch - it cannot use connection marking therefore there is difference is between src/dst. If you ignore killswitch part, it should be practically the same (as long as you mark required connections for NordVPN)…
Could it be that some detail was lost on one of the updates of the commands on the main post?
I did a diff between #1 and #2 and the only difference was the third command:firewall mangecommand on which haddst-*on #2 instead ofsrc-*on #1.
Could this really be the only difference between the 2 methods?
Check your commands one by one. Use WinBox as it’s easier to see in GUI which settings are applied. Maybe you are missing something. Maybe you are confusing something. If 1st method worked, then 2nd should also definitely work too.
My questions is: how can I pass ALL traffic through the tunnel, EXCEPT all traffic meant for 192.168.x.x?
I would probably something like this:
/ip firewall mangle add action=mark-connection chain=prerouting new-connection-mark=unmarkable_nordvpn passthrough=yes src-address=192.168.x.x
/ip firewall mangle add action=mark-connection chain=prerouting connection-mark=!unmarkable_nordvpn new-connection-mark=nordvpn passthrough=yes src-address=192.168.0.0/16
If you don’t use router marking then you could use that, as marker to kill of traffic that is escaping the VPN dynamic SRC-NAT while VPN is being initiated or just have been terminated.
I even use one line for SRC-NAT and one for DST-NAT:
add action=src-nat chain=srcnat routing-mark=Leak-IKEV to-addresses=100.69.69.68
add action=dst-nat chain=dstnat routing-mark=Leak-IKEV to-addresses=100.69.69.69 connection-mark=no-mark
Traffic connection marked is first marked with the routing-mark Leak-IKEV, indicating if this mark is seen it should be Blackholed.
I have this lines in place so that I can see counters/logging of what traffic is blackholed.
I didn’t even realize you could do this with Nord, thanks!!
routing with mange is possible ?
I set 2 ipsec but routing not possible
this fixed my EAP failures. thanks
Initially, i got the ike2/ipsec tunnel up to uk server without issues, traffic flowing via the tunnel but i also was suffering from sloooow browsing performance. i did not do mss mangle rules, implemented the ipsec policy icmp instead (below default and above the other policies)
https://forum.mikrotik.com/posting.php?mode=quote&p=886319
i had to disable the fasttrack filter and mangle entries completely in order to get it to work
browsing is now lightning fast, killswitch works (but have to check on the first few leaked packets as was suggested here)
so probably my fasttrack mangle setup is wrong, but so far happy that it works
hi,
after implementing kill switch:
# Implement a killswitch
/interface bridge add name=nordvpn_blackhole protocol-mode=none
/ip route add gateway=nordvpn_blackhole routing-mark=nordvpn_blackhole
/ip firewall mangle add chain=prerouting src-address-list=local action=mark-routing new-routing-mark=nordvpn_blackhole passthrough=yes
port forwarding stopped working.
src-address-list=local >> this is address range 192.168.88.0/24
i have one port forward rule:
192.168.1.111 : 8080 >> 192.168.88.111 : 8080
OP, thank you for your config and many hours trying to get this working!
Its a bit more advanced than the standard setup that Nord/Mikrotik provide on the forums, but well worth the extra effort…especially the ‘kill switch’ and MTR options. (hint: use Sindy’s workaround) Its also beneficial for n00bs to understand the power of RouterOS. (yes, i’m a n00b and learnt a f*ton! …and still learning )
I used the first option and added any single internal IP to the list to be routed via the NordVPN IPSEC tunnel. I also have a Pi-hole configured that goes out via the tunnel that queries the up stream Nord (in my case) DNS servers. If you’re serious about privacy…get your DNS in check!!!1one 
Best to backup your config before trying this out!
Exclude such VPN traffic from fasttrack
/ip firewall filter add action=accept chain=forward connection-mark=under_nordvpn place-before=[find where action=fasttrack-connection]
This command is wrong as if the heart version removed this function I am using V6.49.1 he will prompt an error, I am copy and paste is to modify what? Can you give me the correct command to copy in, thank you!
Exclude such VPN traffic from fasttrack
/ip firewall filter add action=accept chain=forward connection-mark=under_nordvpn place-before=[find where action=fasttrack-connection]
This one prompts when I copy and paste it in.#####no such item#####
This command is wrong as if the heart version removed this function I am using V6.49.1 he will prompt an error, I am copy and paste is to modify what? Can you give me the correct command to copy in, thank you!