NordVPN troubles

RouterOS General
1

Since Mikrotik supported IKEv2 to ISP I am using NordVPN and I always was very pleased with it. Since the implemented a separate username and password for router implementations things got sometimes wonky.

The latest is that it appears that some sites become unreachable through the VPN and the latest are duckduckgo.com and security.nl and if someone can also test it then I can put this to them. I tested myself and when I use and different VPN provider all goes well.

On my PC I have the client from them and when I want connect to two sites they don’t show using WireGuard. This is punching a hole through the firewall of the router so the router is working fine.

It could of course be the case that those sites are blocking NordVPN but look unlikely to me.

2

I am having some “wonky” Problems with NordVPN too.
Sooo.. You are not alone =)

I just tried it out..
Mikrotik + NordVPN:
I was able to resolve the duckduckgo.com and security.nl domains with the NordVPN-DNS servers
But wasn’t able to connect via HTTP/HTTPS

Firefox + NordVPN Plugin: Everything worked !

3

I am going to ask support with NordVPN now I know I am not the only one. Thank you for confirming this.

Update: support request sent to NordVPN. I will post here their response.

4

Probably a MTU issue. Have a look at this:
http://forum.mikrotik.com/t/mtu-troubles-using-ikev2-providers-like-nordvpn-work-around/135154/1

5

Oh, did not notice it was you msatter…
I use NordVPN as well, without issues.

6

Thanks eworm. Duckduckgo was always a bit tricky but the other site should work.

It could be a geographical and I will try an other country to connect to.

7

I have done a quick check if it is limited to countries and it is.

Does work: Iceland, Ireland, UK, Norway, Denmark and Latvia.
Does NOT work: Belgium and the Netherlands

This tested directly from the client on the PC and not from the router.

8

OK this is not good. I tested it and looking into it with Wireshark I noticed that there where no ICMP 3-4 were returned by NordVPN. They seem to block it and as result the MTU is to big.

I set not in Mangle my outgoing MTU to 1372 (could be in your case lower) and then al is working again. The other VPN providers do work fine without setting the MTU in advance.

add action=change-mss chain=postrouting connection-mark=NordVPN connection-state=new log-prefix=MSS new-mss=1372 passthrough=yes protocol=tcp tcp-flags=syn

This solves not everything, the MTU of UDP traffic is not adjustable in ROS so far I know.

I hope NordVPN is coming back soon my support request so that it can solved in their network. At least they should to allow ICMP 3-4

Update: it seems that they are working on it and the WG server that did not work is working now.

9

It is the MTU that is to big. Normally a ICMP 3-4 is returned if so but NordVPN do not sent them back to us. See my posting above.

10

Is the Problem old or new ?!?

11

Since a week.