Hi all,
I’ve tried to configure the IKEv2 tunnel to allow a single IP (192.168.1.11) on my local network to go to internet, but for some reason the speed I’m able to reach (1mb/sec download and near to 0 upload) is very far from what I get while connecting from the laptop client. Basically, it’s almost impossible to browse internet.
Not sure what I’m doing wrong, but hope you can help (would really appreciate it). At the same time, i’m just a beginner with the router (just received it some days ago). Any idea? It’s possible that I’ve configured something wrong, or that the NAT/Firewall rules are a mess…
Here is my config:
# Import certificate for VPN
/tool fetch url="https://downloads.nordcdn.com/certificates/root.der"
/certificate import file-name=root.der
# Create interface list
/interface list
add name=WAN
add name=LAN
# Create the bridge
/interface bridge
add admin-mac=C4:AD:34:D6:1C:80 auto-mac=no comment=bridge name=bridge
# Add ports to the bridge
/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=sfp1
# Set router IP and network
/ip address
add address=192.168.1.1/24 interface=ether2 network=192.168.1.0
# DHCP server config
/ip pool
add name=dhcp ranges=192.168.1.20-192.168.1.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=DHCPServer
/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1
# DHCP Client
/ip dhcp-client
add interface=ether1
# Neighbor discovery config
/ip neighbor discovery-settings
set discover-interface-list=LAN
# Create VLAN 1 for PPPOE
/interface vlan
add interface=ether1 name=vlan1 vlan-id=100
# Add PPPOE client to vla1
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan1 keepalive-timeout=60 name=pppoe-out1 password=p user=u
# Interfaces list
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
# Detect internet
#/interface detect-internet
#set detect-interface-list=WAN
# Set DNS server
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip dns static
add address=192.168.1.1 name=router.lan
# NordVPN Config
/ip ipsec profile
add name=NordVPN
/ip ipsec proposal
add name=NordVPN pfs-group=none
/ip ipsec policy group
add name=NordVPN
/ip ipsec policy
add dst-address=0.0.0.0/0 group=NordVPN proposal=NordVPN src-address=0.0.0.0/0 template=yes
/ip firewall address-list
add address=192.168.1.11 list=NasVPN
/ip ipsec mode-config
add name=NordVPN responder=no src-address-list=NasVPN
/ip ipsec peer
add address=es55.nordvpn.com exchange-mode=ike2 name=NordVPN profile=NordVPN
/ip ipsec identity
add auth-method=eap certificate="" eap-methods=eap-mschapv2 generate-policy=port-strict mode-config=NordVPN password=p peer=NordVPN policy-template-group=NordVPN username=u
# Firewall NAT rules
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface=pppoe-out1
add action=dst-nat chain=dstnat dst-port=16881 protocol=tcp to-addresses=192.168.1.11 to-ports=16881
add action=dst-nat chain=dstnat dst-port=16881 protocol=udp to-addresses=192.168.1.11 to-ports=16881
add action=dst-nat chain=dstnat dst-port=6881 protocol=udp to-addresses=192.168.1.11 to-ports=6881
add action=dst-nat chain=dstnat dst-port=6881 protocol=tcp to-addresses=192.168.1.11 to-ports=6881
# Firewall rules
/ip firewall filter
add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=accept chain=input comment="accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="fasttrack" connection-state=established,related
add action=accept chain=forward comment="accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward connection-nat-state=dstnat
# Hotspot config
#/ip hotspot profile
#set [ find default=yes ] html-directory=flash/hotspot
# Minor config params
/system clock
set time-zone-name=Europe/Madrid
/tool graphing interface
add interface=pppoe-out1
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Thanks a lot in advance!!