Hello,
Before I was on AzireVPN, where here good users helped to configure it 
http://forum.mikrotik.com/t/wireguard-azirevpn-misbehavior/165351/1
So after setting up all, being happy for 1y+ , they change the Port forward policyā¦i decided to try new provider.
I came around this AirVPN and seems to have big community and stable service, so i gave it a tryā¦
I realized new feature in WinBox - Wireguard - WG Import - Greaat!
Mikrotik OS is on 16.2 , but on my BITTER surprise - WG Import doesnāt workā¦
I checked OS update and 7.17 (yesteday fresh update), probably a bug in previous FW, so did update and same problemā¦
This drives me Insane so many years on market and still issues with OpenVPN / Wireguard seamless configs imports
-Did ticket and got notice just now - This is fixed on 7.18beta (at least they are fast)
Anyway back to ISSUE spend few hours to set all manually (based on previous AzireVPN provider settings) into some working level.
My setup is that i have also Docker hosted on Server for PiHole where I have 2x DNS from previous provider (still working fine)
AzireVPN
91.231.153.2
192.211.0.2
Now the issues are:
-
AirVPN DNS 10.128.0.1 seems to be working only if the client (VPN Whitelist) is connected to the VPN tunnel
-
The rest clients (not on VPN) are having issues with pages , connectivity etc. (using AirVPN DNS 10.128.0.1)
When is take Client1 out from VPN and is connected āvia regular internetā issues with pages are gone and everything runs/loads smoothly.
VPN Client list i manage via routing table (not sure if there is any other better way)
/routing rule
add action=lookup-only-in-table comment=ZigBee-Hub disabled=no src-address=\
192.168.10.20/32 table=main
add action=lookup-only-in-table comment=Mini-PC disabled=yes src-address=\
192.168.10.50/32 table=main
add action=lookup-only-in-table comment="Redmi 8" disabled=no \
src-address=192.168.10.64/32 table=main
add action=lookup disabled=no src-address=192.168.10.0/24 table=useWG
- I removed completely AirVPN DNS 10.128.0.1 and kept only 91.231.153.2 , 192.211.0.2 on Pihole
Now nonVPN clients run great all pages etc.
Client on Air VPN tunnel runs 80-90% fine some pages do not load or partially and for example paint.NET update is faling (see pic) vs On nonVPN clients work fine
I recall having similar issues with AzireVPN and then someone suggested:
"With adding the command , started to work, changing to MTU 1500 didnt worked out.
/ip firewall mangle
add action=change-mss chain=forward comment=āClamp MSS to PMTU for Outgoing packetsā new-mss=clamp-to-pmtu out-interface=wg-az-se-sto passthrough=yes protocol=tcp tcp-flags=syn
"
I tried to edit it for current interface , seems it help at bit to get access , but somehow the few MB update is extremely slow
even speed on VPN is like 50/5mb (before i start to look for faster server, would like to have this issue resolved)
Also how is see that something is not right is via this Browser plugin (https://github.com/AykutCevik/Geolocate-IP-Browser-Extension)
Where it shows ERROR and no data about IP vs in normal state it changes/update country flag within seconds
Here is my config:
Seems like now they have new feature https://help.mikrotik.com/docs/spaces/ROS/pages/328155/Configuration+Management
show-sensitive (yes|no; Default: no). RouterOS version 7 only
hide-sensitive (yes|no; Default: no). RouterOS version 6 only
So hope all needed is there
#doesnt work with =yes / no switch
export hide-sensitive=yes file=VPN
#works
export hide-sensitives file=VPN
# 2025-01-25 12:20:13 by RouterOS 7.17
# software id = NNA1-7M3W
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = xxx
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge \
port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] comment=WAN mac-address=XX:XX:XX:XX:XX:XX \
name=ether1-WAN
/interface wireguard
add listen-port=13231 mtu=1320 name=AirVPN_Sweden
add comment=back-to-home-vpn disabled=yes listen-port=40556 mtu=1420 name=\
back-to-home-vpn
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=2ghz-ax disabled=no frequency=2422,2447,2467 name=ch-2ghz \
skip-dfs-channels=10min-cac width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5260,5320 name=ch-5ghz \
skip-dfs-channels=10min-cac width=20/40/80mhz
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=wifi-sec wps=\
disable
/interface wifi configuration
add antenna-gain=0 channel=ch-2ghz country=Czech disabled=no name=\
wifi-conf-2.4Ghz security=wifi-sec ssid=XXX
add antenna-gain=0 channel=ch-5ghz country=Czech disabled=no name=\
wifi-conf-5Ghz security=wifi-sec ssid=XXX_5G
/interface wifi
add configuration=wifi-conf-5Ghz configuration.mode=ap .tx-power=24 disabled=\
no name=cap-wifi1 radio-mac=XX:XX:XX:XX:XX:XX
add configuration=wifi-conf-2.4Ghz configuration.mode=ap .tx-power=24 \
disabled=no name=cap-wifi2 radio-mac=XX:XX:XX:XX:XX:XX
set [ find default-name=wifi1 ] configuration=wifi-conf-5Ghz \
configuration.mode=ap disabled=no name=wifi1-5g
set [ find default-name=wifi2 ] configuration=wifi-conf-2.4Ghz \
configuration.mode=ap disabled=no name=wifi2-2g
/iot lora servers
add address=eu1.cloud.thethings.industries name="TTS Cloud (eu1)" protocol=\
UDP
add address=nam1.cloud.thethings.industries name="TTS Cloud (nam1)" protocol=\
UDP
add address=au1.cloud.thethings.industries name="TTS Cloud (au1)" protocol=\
UDP
add address=eu1.cloud.thethings.network name="TTN V3 (eu1)" protocol=UDP
add address=nam1.cloud.thethings.network name="TTN V3 (nam1)" protocol=UDP
add address=au1.cloud.thethings.network name="TTN V3 (au1)" protocol=UDP
/ip kid-control
add fri=0s-1d mon=0s-1d name=system-dummy sat=0s-1d sun=0s-1d thu=0s-1d tue=\
0s-1d tur-fri=0s-1d tur-mon=0s-1d tur-sat=0s-1d tur-sun=0s-1d tur-thu=\
0s-1d tur-tue=0s-1d tur-wed=0s-1d wed=0s-1d
add disabled=yes fri=17h30m-19h mon=17h30m-19h name=kids sat=17h30m-19h30m \
sun=17h30m-19h thu=17h30m-19h tue=17h30m-19h wed=17h30m-19h
/ip pool
add name=dhcp ranges=192.168.10.10-192.168.10.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=10m name=dhcp1
/ip smb users
set [ find default=yes ] disabled=yes
/queue simple
add comment=Arduino-Box max-limit=10/10 name=Arduino-Box target=\
192.168.10.112/32
add comment=Arduino-Garaz max-limit=10/10 name=Arduino-Garaz target=\
192.168.10.110/32
/queue tree
add max-limit=1G name=TotalBand parent=global
add max-limit=50M name="01 Games" packet-mark=games parent=TotalBand
add max-limit=20M name="02 YouTube" packet-mark=youtube parent=TotalBand
add comment="Browsing, downloads" max-limit=1G name="03 Other" packet-mark=\
no-mark parent=TotalBand
/routing table
add disabled=no fib name=useWG
/zerotier
set zt1 disabled=no disabled=no
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=wifi1-5g internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=wifi2-2g internal-path-cost=10 \
path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set allow-fast-path=no
/ipv6 settings
set max-neighbor-entries=15360
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=\
all wan-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1-WAN list=WAN
/interface wifi access-list
add action=reject allow-signal-out-of-range=10s disabled=no interface=\
wifi1-5g signal-range=-120..-85
add action=reject allow-signal-out-of-range=10s disabled=no interface=\
wifi2-2g signal-range=-120..-85
/interface wifi capsman
set ca-certificate=auto enabled=yes package-path="" require-peer-certificate=\
no upgrade-policy=require-same-version
/interface wifi provisioning
add action=create-enabled disabled=no master-configuration=wifi-conf-5Ghz \
supported-bands=5ghz-ax
add action=create-enabled disabled=no master-configuration=wifi-conf-2.4Ghz \
supported-bands=2ghz-ax
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=se3.vpn.airdns.org \
endpoint-port=51820 interface=AirVPN_Sweden name=peer4 \
persistent-keepalive=35s preshared-key=\
"XXX" public-key=\
"XXX"
/iot lora traffic options
set crc-errors=no
set crc-errors=no
/ip address
add address=192.168.10.1/24 comment=defconf interface=bridge network=\
192.168.10.0
add address=10.142.189.241 interface=AirVPN_Sweden network=10.142.189.0
/ip cloud
set back-to-home-vpn=enabled ddns-enabled=yes ddns-update-interval=10m
/ip cloud back-to-home-users
add allow-lan=yes comment=" Xiaomi 2201122G" name="MikroTik hAP AX3" \
private-key="XXX" public-key=\
"XXX"
/ip dhcp-client
add comment=defconf interface=ether1-WAN
/ip dhcp-server lease
add address=192.168.10.50 client-id=1:a8:a1:59:44:6f:3b comment=MiniPC \
mac-address=A8:A1:59:44:6F:3B rate-limit=1000M/1000M server=dhcp1
add address=192.168.10.70 client-id=1:4:cf:8c:e8:42:18 comment="Vacuum" \
mac-address=04:CF:8C:E8:42:18 server=dhcp1
/ip dhcp-server network
add address=192.168.10.0/24 comment="VPN DNS Servers" dns-server=192.168.10.2 \
gateway=192.168.10.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.10.51 list=No-Internet
add address=se3.vpn.airdns.org list=3rdPartyVPN2
/ip firewall filter
add action=jump chain=forward comment="jump to kid-control rules" \
jump-target=kid-control
add action=log chain=forward connection-state=new disabled=yes dst-port=\
80,443 log=yes protocol=tcp
add action=drop chain=forward comment="No-Internet Rule" log=yes log-prefix=\
Blocked-Internet-Tries out-interface-list=WAN src-address-list=\
No-Internet
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input dst-port=51820 in-interface=ether1-WAN \
protocol=udp
add action=accept chain=input comment="defconf: allow all coming from LAN" \
in-interface-list=LAN
add action=accept chain=input comment="allow Winbox" port=8291 protocol=tcp
add action=drop chain=input comment="drop all else"
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=accept chain=forward in-interface=bridge out-interface-list=WAN
add action=accept chain=forward in-interface=bridge out-interface=\
AirVPN_Sweden
add action=accept chain=forward comment="port forwarding" \
connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
/ip firewall mangle
add action=change-mss chain=forward comment=\
"Clamp MSS to PMTU for Outgoing packets" new-mss=clamp-to-pmtu \
out-interface=AirVPN_Sweden protocol=tcp tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=AirVPN_Sweden
add action=dst-nat chain=dstnat comment=Loxone dst-port=7777 in-interface=\
ether1-WAN log=yes log-prefix=Loxone protocol=tcp to-addresses=\
192.168.10.100 to-ports=7777
add action=dst-nat chain=dstnat comment="Transmission BT - Work" dst-port=\
7778 in-interface=ether1-WAN log=yes protocol=tcp to-addresses=\
192.168.10.101 to-ports=7788
add action=dst-nat chain=dstnat comment="Transmission BT - VPN" dst-port=\
54518 in-interface=AirVPN_Sweden log-prefix=TransmissionBT protocol=tcp \
to-addresses=192.168.10.101
add action=dst-nat chain=dstnat comment="Transmission BT - VPN" dst-port=\
54518 in-interface=AirVPN_Sweden log-prefix=TransmissionBT protocol=udp \
to-addresses=192.168.10.101
add action=dst-nat chain=dstnat comment="Transmission BT - VPN" dst-port=\
54519 in-interface=AirVPN_Sweden log-prefix=TransmissionBT protocol=tcp \
to-addresses=192.168.10.101
add action=dst-nat chain=dstnat comment="Transmission BT - VPN" dst-port=\
54519 in-interface=AirVPN_Sweden log-prefix=TransmissionBT protocol=udp \
to-addresses=192.168.10.101
add action=dst-nat chain=dstnat comment="SSH Router" disabled=yes dst-port=\
2220 in-interface=ether1-WAN log=yes protocol=tcp to-addresses=\
192.168.10.1 to-ports=2222
/ip firewall service-port
set ftp disabled=yes
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip kid-control device
add mac-address=60:45:CB:9A:3F:F0 name=Tower user=system-dummy
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=AirVPN_Sweden \
routing-table=useWG scope=30 suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh port=2222
set api disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/routing rule
add action=lookup-only-in-table comment=Mini-PC disabled=yes src-address=\
192.168.10.50/32 table=main
add action=lookup-only-in-table comment=Laptop disabled=no \
src-address=192.168.10.51/32 table=main
add action=lookup disabled=no src-address=192.168.10.0/24 table=useWG
/system clock
set time-zone-name=Europe/Prague
/system identity
set name="MikroTik hAP AX3"
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.cz.pool.ntp.org
add address=time1.google.com
add address=time2.google.com
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
)
