Hi, thanks for replying. I tried the suggested command but I got an error. I think it is because I don’t have a routing table with the name under_nordvpn. Sorry, I am really a newbie with Mikrotik. Could you elaborate? Here is the error: “input does not match any value of routing-table”
Hmm that seems not to be possible and the IKEv2 connect directly to WAN and in my case that is the PPPoE.
The thread is marked only for ROSv6 so even the writer didn’t found a way to implement also the kill-switch.
Thanks for replying, so it is not possible to implement a kill switch on ROS7?
When the connection is active you see an dynamic line appear in NAT.
Copy that line and change the action dst-addres to 100.69.69.69 and save. That IP goes nowhere.
When the VPN goes down this line is still there and also it catch traffic when the VPN is still cranking up.
Thank you very much for your attention! Unfortunately I will not be able to test it for a while, as I downgraded to ROS6. In ROS6 everything works fine and with a huge bonus: the speed is way higher!
On ROS7 I was getting about 230/230 Mbps down/up and with ROS6 I am getting 450/250 Mbps down/up. My internet is 600/300 Mbps. My router is the RB4011.
One last question, is there a way that I could still access my modem setup page while I am connected to the VPN? I am connected to the modem with PPPoE and I have an WAN IP defined on the same modem network, so I can access the modem when I type its IP which is 192.168.15.1 from my internal network which is 192.168.0.x. If I try to access the modem from an IP in the under_nordvpn list, I cannot access it. So could you please help me with that?
Hello again,
Just replying to myself and to help others: I was able to access the modem setup page putting its address(Dst. Address: ! 192.168.15.1) in the mangle rule that marks the VPN connection and in the mangle rule that sends the to the blackhole. It is working. Do you have any comments about that?
Do you have any comments
From what I understand this is your network diagram.
Internet<----------->ISP<------------>Modem<-------PPPOE-DHCP-DNS--------->MT<-------- DHCP-DNS-VPN----------->Clients
If the answer is yes, you should design your network with minimal few running services as possible.
Internet<----------->ISP<------------>Modem<-------bridge--------->MT<--------PPPOE OUT-DHCP-DNS-VPN----------->Clients
*** WARNING WARNING WARNING ***
DON’T RESET your NordVPN account password when you notice that you can’t login to your account on the NordVPN website.
You will lose the usage of your VPN connections because you are forced to use a multi factor authentication on the same device, through the NordVPN APP.
There is not APP for the routers or the Linux shells.
Support is not responding on this because they are most likely overloaded on this topic of users that can’t use their paid VPN anymore.
Bye.
*** Update ***
My support e-mails went unanswered so I tried chat. I had all the info ready and the terminal running to try suggestions and after the person had to check thing out a solution was given.
Using the browser can be avoided by using the legacy mode of the Linux client with the command: nordvpn login --legacy
How long this is kept working is unknown but at-least I can get now my updated private-key for Wireguard this way. It would be much nicer if that private-keys could be set/changed on the account pages like Mullvad and ProtonVPN allow.
I moved on from IKEv2 to WireGuard and how to get that working is for you to find out.
Bye
The method proposed by msatter allows the MTU issue to be dealt with in the way it was designed to be handled. It allows the maximum MTU to be used and doesn’t just blindly set the MTU to a lower value.
Hi everyone and thanks for this awesome guide, i actually spent too much time before found it. But i need some help. I used to use PPTP client for my purposes (some devices in local network should strictly go only through VPN), it was going by this
/ip route rule add action=lookup-only-in-table src-address=“LOCAL_IP” table=“PPTP_CLIENT_NAME”
But now i have no idea how to realise it with NordVPN(IPSEC/IKEv2), could anyone help me? 
Hello,
I hope someone is able to help me. From time to time my VPN just becomes dead(cannot send or receive any traffic) and I need manually to flush the SA keys.
I was thinking about writing a script to ping through the VPN and if it shows it is dead, I can flush the keys. My question is how can I do that as the ping command does not pass through the VPN?
Can someone please shed some light?
**update 09/07/23 > Have read some articles but still not been able to get this working..Any help appreciated.
Hi all, I’ve been able to follow and setup nord #1 instructions it works well but I want to be able to reach my LAN network (192.168.0.0/24) which sits behind the mikrotik so i can access my CCTV camera’s through the mikrotik’s wifi.
The mikrotik obtains an IP 192.168.0.20 from the DHCP LAN network and the mikrotik bridge network is default 192.168.88.0/24. Running ROS6.
Could someone please advise the additional config required to allow access to the LAN through the mikrotik WiFi connection. Thanks 
Does anybody convert this for ROS7? VPN kill switch doesn’t work.
Why use IKEv2while there is Wireguard on ROSv7!?
https://nordvpn.com/blog/nordlynx-protocol-wireguard/
http://forum.mikrotik.com/t/nordlynx-server-wireguard-setup/156064/1
I love you, man! I’ve been searching for NordVPN tutorials which worked but the internet speed was so slow until today. I had only been using SmartDNS, which worked excl Netflix. By the way, it also works on RouterOS 7+. Thank you once again.
thank you man, great help