OK, success ! I seem to be sending all traffic over the Proton VPN … here is my config for anyone who is stuck -
# aug/06/2020 21:23:22 by RouterOS 6.47.1
# software id = 1E7M-1D8F
#
# model = RB4011iGS+
# serial number = serial
/interface bridge
add admin-mac=18:1F:1A:12:16:15 auto-mac=no comment=defconf name=bridge
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 \
password=password use-peer-dns=yes user=username
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec mode-config
add name=ProtonVPN responder=no src-address-list=local
/ip ipsec policy group
add name=ProtonVPN
/ip ipsec profile
add enc-algorithm=aes-256 hash-algorithm=sha256 name=ProtonVPN
/ip ipsec peer
add address=nl.protonvpn.com exchange-mode=ike2 name=ProtonVPN profile=\
ProtonVPN
/ip ipsec proposal
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc name=ProtonVPN \
pfs-group=none
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=\
192.168.88.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.88.0/24 list=local
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=change-mss chain=forward ipsec-policy=in,ipsec new-mss=1300 \
passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip ipsec identity
add auth-method=eap certificate="" eap-methods=eap-mschapv2 generate-policy=\
port-strict mode-config=ProtonVPN password=vpnpass peer=\
ProtonVPN policy-template-group=ProtonVPN username=\
vpnuser
/ip ipsec policy
add dst-address=0.0.0.0/0 group=ProtonVPN proposal=ProtonVPN src-address=\
0.0.0.0/0 template=yes
/ip service
set telnet address=192.168.88.0/24
set ftp address=192.168.88.0/24
set www address=192.168.88.0/24
set ssh address=192.168.88.0/24
set api address=192.168.88.0/24
set winbox address=192.168.88.0/24
set api-ssl address=192.168.88.0/24
/system clock
set time-zone-name=Europe/London
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
I added the MSS clamp because there seemed to be an issue loading some pages … but the config should still basically work without it. Think the old issue may have been the source address list I defined in ipsec mode config … but not certain since I’m not an expert. Anyway it works now apparently(don’t forget to load your certificates first).
Just like to point out the extra policy that Sindy noted near the beginning of this thread. It might solve your packet issues and resolve the mss issue
I am kinda new to Mikrotik, so would appreciate if you’ve got this figured & fixed to post a little How To/ Tutorial/ Or key steps (maybe leverage an existing How To w some changes)?
Not sure if it’s any help to you guys but SurfShark has a full on guide to setting up IKEv2 VPNs on their site, only issue I found was using the servers dns name drops every 5-10 seconds, but using the Ip address of that server works flawlessly. I’m getting around 250mbps between USA and Iceland, about 150mbps between USA and their multihops…
OK. So first, confirm you have changed the password and/or username on the /ip ipsec identity row before posting the export; if you haven’t, change the password at your Proton account (and update it in the identity on the Mikrotik).
Second, do the following:
disable the peer or identity representing the Proton VPN
issue a command /system logging add topics=ipsec,!packet
issue a command /log print follow-only file=ipsec-start where topics~“ipsec”
enable the peer or identity you have disabled in step 1
after 5 seconds, break the /log print … command from step 3, download the file ipsec-start.txt and open it in your favourite text editor
find the EAP failed line and see what’s next, there should be some details on the failure.
The colon after “EAP failed” was promising, but as the log shows it was a notification from the server side, it is unlikely the log will shed more light on the reason of the failure. However, if you are absolutely sure that the username and loging are correct (e. g., do they use the same credentials for account management via web and for the VPN authentication?), do post the complete log, I dn’t completely exclude that some hint can be found there.
OK, I’ve missed that on your /ip ipsec identity row.
Remove the certificate item from there. The Proton’s root CA certificate you have imported is used by your Mikrotik to verify validity of the certificate provided by the responder (“server”) to authenticate itself to you. Your Mikrotik uses username and password, not certificate, to authenticate itself to the responder. By configuring a certificate, you tell it to use it instead, which confuses the responder. The fact that you’ve used the particular certificate for a wrong purpose is a secondary issue.
The differences to my working ProtonVPN configuration are the following:
different ProtonVPN server used (different peer address)
eap-methods=eap-mschapv2**,eap-peap,eap-ttls**
As the guy above you is successful with eap-mschapv2 alone, I can’t say which of the differences are more important. Maybe something has changed in the meantime.
hmm tried just for the fun of it to remove mschapv2 and added eap-peap,eap-ttls
now my log looks like this
17:49:20 ipsec ← ike2 request, exchange: AUTH:5 193.148.18.40[4500] 1d1480f532a080d8:79e854109793983f
17:49:20 ipsec,debug ===== sending 272 bytes from 89.xxx.xxx.xxx[4500] to 193.148.18.40[4500]
17:49:20 ipsec,debug 1 times of 276 bytes message will be sent to 193.148.18.40[4500]
17:49:20 ipsec,error EAP failed: handshake failed: self signed certificate
17:49:20 ipsec,info killing ike2 SA: 89.xxx.xxx.xxx[4500]-193.148.18.40[4500] spi:1d1480f532a080d8:79e854109793983f
17:49:20 ipsec KA remove: 89.xxx.xxx.xxx[4500]->193.148.18.40[4500]
17:49:20 ipsec,debug KA tree dump: 89.xxx.xxx.xxx[4500]->193.148.18.40[4500] (in_use=1)
17:49:20 ipsec,debug KA removing this one…
