The free server is a bit funky.
I get some web pages working fine, Google webpage/search doesn’t work at all. DNS does though although I use 8.8.8.8 and 1.1.1.1 so no idea if my dns switched provider.
This issue might be my config and not related to the free server.
Anyway, speedtest net mobile app ran at 2mbs down then failed the upload. After that, web pages started to fail for a few minutes.
I also got a strange leak, temporarily, as whatismyip changed back to UK. Maybe it was a cached result I don’t know (one result only and occurred after the tunnel fail/stall - and I think the tunnel did drop for a moment and hence the reason for speedtest fail).
In the end I did get consistent NL ip addresses.
As for the leaks, you have to make sure that while the VPN is down for any reason, packets are not routed the normal way via WAN. But because IPsec policy matching, and eventual packet redirection to the IPsec SA, requires that the packets were routed the normal way first, you need that the normal routing always sends them somewhere. The simplest way to achieve this is to add an /interface bridge without any member interfaces, and make it the gateway of the default route in a dedicated routing table for traffic which should only go via the VPN. Marking packets to use a specific routing table is called policy routing throughout Mikrotik documentation and it has nothing to do with IPsec policies. It is also possible to change the gateway of the default route in the main routing table and add dedicated routes towards the VPN server itself that use the default gateway, but with a DHCP client on WAN, this way is more complex than use of policy routing.
As for some sites working weird or not at all, there is the issue with path MTU discovery. When a packet sent by your PC is too large to fit to the WAN interface after getting wrapped into the IPsec headers and footers, the Mikrotik sends back an ICMP “fragmentation needed” message and the PC sends a smaller slice of the byte stream from the output buffer. But as the source address of that ICMP packet is Mikrotik’s own one in the subnet where the PC is, and as the destination address of the IPsec policy is “anywhere”, these packets are also redirected to the SA. Hence you have to place a static action=none src-address=0.0.0.0/0 dst-address=your.lan.sub.net/mask row into the /ip ipsec policy tablebefore (above) the template from which the actual policy is generated when the IKEv2 connection establishes. The IPsec policy matching is done the same way like firewall rule matching, top to bottom until first match, so this added policy prevents packets sent by the router itself to its LAN clients from being redirected.
Hi Sindy,
Your second point about IPsec and mtu. I am confused.
I understand the mtu and your reasons but not sure how to solve it with the additional rule. Is that a firewall rule or something I setup in NAT or IPSEC?
As I wrote, it is an IPsec policy, i.e. a row (or rule if you want) in the /ip ipsec policy table.
There are two types of rows in this table - actual policies and templates. The templates are used to create actual policies dynamically if /ip ipsec identity row permit this (and refers to a policy template group); the dynamically created policies appear after (below) the template from which they were created. So once you have the connection up, add the policy described above (an actual policy, not a template) and drag it above the template from which the dynamic policy has been created. As it is created manually, it survives a disconnection and re-connection of the IKEv2 session.
Not all ICMP packets. Only those sent by the Tik itself to the LAN clients, because the source address of these packets is from the LAN subnet, which you src-nat to the IP address assigned by the remote IPsec responder (server) by means of mode-config. So another possible remedy is to populate the address-list to which your mode-config row refers so that it would not contain the LAN IP of the Mikrotik itself.
I have managed to setup Proton VPN on Mikrotik according this thread, its working , but the connection drops approximately every 4 hours. There is no error, even if I enable ipsec debug log…
I’ve entered the setup and have a connection to the Proton server -
[admin@MikroTik] > /ip ipsec active-peers print
Flags: R - responder, N - natt-peer
# ID STATE UPTIME PH2-TOTAL REMOTE-ADDRESS DYNAMIC-ADDRESS
0 N 37.120.215.244 established 3h14m11s 1 37.120.215.244
I want to send all my LAN(192.168.88.0/24) traffic over the VPN, so I entered the following from the Mikrotik Nord VPN example -
From the bits of information you’ve posted instead of the complete configuration, I assume that you didn’t get the purpose of setting the connection-mark in the /ip ipsec mode-config row.
You can use src-address-list, connection-mark, or both, but if you use both, packets need to match both to get src-nated by the dynamically created action=src-nat rule. Since you haven’t posted any /ip firewall mangle rule, I assume you don’t assign the connection-mark, so I guess it is enough to unset the connection-mark in the /ip ipsec mode-config row and you should be good.
I’ve tried removing the connection mark and traffic is still not being routed over the active VPN connection, any ideas? It’s probably something simple, here’s my router config -
# aug/04/2020 12:19:10 by RouterOS 6.47.1
# software id = 1E7M-1D8F
#
# model = RB4011iGS+
# serial number = serial
/interface bridge
add admin-mac=58:3F:1A:22:16:1C auto-mac=no comment=defconf name=bridge
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 \
password=pass use-peer-dns=yes user=myuser
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec mode-config
add connection-mark=no-mark name=ProtonVPN responder=no src-address-list=\
local
/ip ipsec policy group
add name=ProtonVPN
/ip ipsec profile
add dh-group=modp4096,modp2048,modp1024 dpd-interval=disable-dpd \
enc-algorithm=aes-256 hash-algorithm=sha256 name=ProtonVPN
/ip ipsec peer
add address=us.protonvpn.com exchange-mode=ike2 name=ProtonVPN profile=\
ProtonVPN
/ip ipsec proposal
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc name=ProtonVPN \
pfs-group=none
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=\
192.168.88.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=10.5.8.0/24 list=local
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip ipsec identity
add auth-method=eap certificate="" eap-methods=eap-mschapv2 generate-policy=\
port-strict mode-config=ProtonVPN password=vpnpass peer=\
ProtonVPN policy-template-group=ProtonVPN username=\
vpnuser
/ip ipsec policy
add dst-address=0.0.0.0/0 group=ProtonVPN proposal=ProtonVPN src-address=\
0.0.0.0/0 template=yes
/system clock
set time-zone-name=Europe/London
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
That suggesting was made to detect an error easier by having only one point of failure. Then you posted your config where looked for connection-marking in Mangle and found none.
The Wiki page linked to by Kams19 explains it in detail.
Issueing exactly the same commands posted by newbeen (with username and password adapted) the tunnel doesn’t come up (ipsec active-peers table stays empty).
Is a particular version required (we use the latest LTS, 6.45.9)? Are additional packages needed (we only have basics, with hotspot, ipv6, mpls, ppp and routing disabled)? How can we access to a log (nothing appears on /log except for the audit of the configuration beeing issued) or even better a debug?
We are stuck ont the first part, establishing an IPSEC IKE v.2 tunnel; we aren’t yet even facing the aspect of selecting which traffic to route towards the tunnel.
