Tunnel traffic through VPN

RouterOS Beginner Basics
1

Hi,

I run a small WiFi Hotspot for hotel guests. We had a small legal issue because some of our clients are downloading illegal movies from Bittorent websites.

  1. Is it possible to tunnel all the traffic trough a VPN provider?
  2. Which VPN provider is supported by Mikrotik?
  3. Are there any providers which already have filters for illegal BitTorrent websites? Or the possibility to block Bittorent at all?
  4. Can I block somehow Bittorent with my Mikrotik router?

Regards

2

RouterOS supports creating VPN tunnels, I know L2TP is supported as I use it myself. As long as a standard (though perhaps not bleeding edge) protocol is used, it’ll be supported.

Alternatively, you could just block the relevant bittorrent protocol ports using the RouterOS firewall.

3

I blocked the ports in my fritzbox and does not help. Bittorent just try to use other ports.

I found a VPN provider (NordVPN) which is using internally OpenVPN. Is this a good or bad idea to use OpenVPN? We have up to 100 Users in the guest WiFi and all are limited to 6MBbs/down and 256kb/up-stream.

4

It is unlikely that the MikroTik OpenVPN implementation is going to work with them.
(I have no personal experience with this particular combination, but in general MikroTik OpenVPN is missing a lot of features that most servers require these days)

You will have more luck with IPsec (IKEv2) I think.

5

Okay thank you for this information.

I tried https://www.expressvpn.com/ on my desktop, but I get only 25-100mbit/s

I have a 400mbit connection it would be nice if I could use at least 200mbit. Any recommendation for a good VPN service?

6

I’m using NordVPN for now, but I’d like to change it to another one, because of low connection. So If anyone got an idea, I’d connect to the topic too.

7

NordVPN is fast and I get with two RB760iGS in cascade 250/250Mbit/s. Single RB760iGS shuffles around 170Mbit/s over the IKEv2 tunnel.

With a RB4011 you will get between 250 an 300Mbit/s through NordVPN.

8

What router type do you have? Of course this is not going to work with a RB2011 or RB750G2!
You need a modern router with encryption acceleration to get those high speeds.

9

What about not encrypting the connection and just use L2TP?

https://mikrotik.com/product/hex_s
Is this one powerfull enough? I have a RB750G2 at the moment running

10

Your VPN provider probably does not offer that option.

Yes, the hEX S (or the normal hEX, this is now the RB750Gr3) is powerful enough for fast IPsec encryption at the speed you want.
This of course still does not guarantee you will achieve that speed, there can be other bottlenecks in the network.
But 200 Mbps should be possible.

11

I tried PPTP, LT2P and LT2P with IPSec

All of them are extremly slow. (Around 1Mbit)

Only LT2P with IPSec gives me SOMETIMES 10MBit.

I followed this instruction: https://support.safervpn.com/hc/en-us/articles/115004457365-Manual-PPTP-setup-on-Mikrotik-Router

I have the feeling that there is a problem with this configuration. I tried LT2P without IPSec on my desktop and I get speeds around 250Mbit…

12

You probably will have MTU issues that are usual with VPN. Try to add this:

/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn
13

The 750GR2 does not support hardware encryption, I can’t find it being stated, and it has the QCA9556 as processor.

https://wikidevi.com/wiki/MikroTik_RouterBOARD_hEX_(RB750Gr2)

The 750Gr3 and 760IGs do support hardware encryption and many more Mikrotik routers.

14

Thank you! MTU was a problem!

The command did not help but I played manually with the values and now I get speeds around 140Mbit/s (Only LT2P without IPSec)

I am tunneling now all my traffic through the VPN. Because of this I can not connect to my DNS-Server on my router.

In the document here: https://support.safervpn.com/hc/en-us/articles/115004457365-Manual-PPTP-setup-on-Mikrotik-Router they are adding manually some DNS Server.

  1. But what they do is not working for me
  2. It feels a bit hacky
  3. I guess it would be best to use the DNS Server which is configured in my router. But how could I do this?
15

When you buy an different router with hardware support you can use IKEv2 which is safe, L2TP is not, you can use connection marking by default to split traffic to go into the tunnel and traffic that that not has to be in the tunnel.

You can then use your local DNS if you want.

16

Security is not an issue.

you can use connection marking by default to split traffic to go into the tunnel and traffic that that not has to be in the tunnel.
How is this feature called? I what like to read more about this

Also I have a problem that netflix and amazon is not working through that tunnel. Can I also use the above technic to prevent that kind of traffic to not go through the tunnel?


https://mikrotik.com/product/hex_s#fndtn-testresults
This is also interessting. Increasing the MTU seems to speed up everything. This is something I would like to try tonight.

17

For this purpose it does not really matter if the VPN is “safe”…
Traditionally VPN was used to inter-connect two isolated networks (e.g. subsidiary local area networks) over a public network, and it was important to make sure that someone who could capture packets on the public network would not be able to look into the transported packets, insert new packets into the stream to attack systems on the isolated networks, etc.
Hence the use of authentication and encryption.

However, today most people (including the starter of this topic) use VPN in a slightly different meaning: to transport all their traffic that is to be sent to/from the public network to another place where it will then be released onto the public network.
They can do that for a couple of reasons:

  • because their local connection is unsafe and can be tapped by bystanders (e.g. public WiFi)
  • because their ISP is somehow modifying the traffic in a way they don’t desire (e.g. interception of DNS requests and insertion of own code into http traffic)
  • because they do not want to associate their traffic exit-point with themselves
  • because they want to have their traffic exit-point in another country, e.g. to circumvent regional locking

In all but the first case it does not really matter how safe it is. You could just use an unencrypted GRE or IPIP tunnel. In the second case it could be problematic but it probably isn’t, the ISP likely is not going to the trouble to look in such tunnels anyway.

So in fact this security is only burdening the router, which has to encrypt and decrypt everything, and it has costs in performance due to the larger headers of encrypted/authenticated tunnels vs the simple ones. With a better router (like RB750Gr3) you won’t be troubled by the encryption CPU overhead, but you still have the header overhead.

Of course when you want to use an existing “VPN provider” (in the sense of providing a different exit-point) and it likely does not provide the option of using such simple tunnels. So then you are obliged to jump to the “secure” hoops, even though it is not really needed.

18

https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle
at the bottom of that page.

19

I can’t get it work. How can I accept the traffic to the DNS Server on my router which uses the IP 192.168.178.1 ?

20

Hi regarding Amazon video problem - not working via vpn - do you have a working script/mangle rules… a actual ip-adress list of amazon servers etc. ?
i was already thinking before to route the amazon traffic directly to the internet without using the vpn, but i have no idea how to manage it…