I’m looking at using a commercial VPN provider directly on a MikroTik router rather than relying on desktop or mobile apps.
One of the services I’ve been looking at is CometVPN
For RouterOS users, what tends to matter most in practice when choosing a provider? I’m mainly thinking about straightforward WireGuard or OpenVPN configuration, stable endpoints, DNS handling and whether policy routing is easy to manage.
I’d also be interested in how people here usually structure the setup when only selected devices or VLANs should go through the VPN while the rest use the normal WAN connection.
Any particular provider-side limitations worth checking before setting this up on MikroTik?
I have NordVPN over WG setup on ROS, not using this connection regularly and it is there for enabling it on demand (recently I used it for making this post Firmware downloads are slow and often fail - #42 by optio ). Here are some setup instructions for it NordVPN slow performance - #15 by optio . With NordVPN you can create many WG peers per country so that you can have possibility to switch country over which VPN connection will be established, by enabling/disabling its peers.
I'm using own DNS server in container which uses public DNS (DoT) as upstream, so I don't have issue with DNS when connections are routed over VPN, if you are using ISP DNS you will probably need to set VPN or public DNS IP in DHCP server network settings to be provided to clients which will be routed over VPN or setup DNS Hairpin NAT to override DNS connection for network routed over VPN, because most ISPs doesn't allow connection to their DNS from other networks.
Regarding provider-side limitations, not sure on which provider you mean, ISP or VPN provider? For eg. for VPN provider side can be issue if VPN server IP or WG keys are changed which are dynamically provided to VPN app over some API, but on ROS is statically configured and needs to be changed manually, unless some config monitor scheduled script is created and updates it, using NordVPN provided API that could be possible to implement, but I did not find a need to create that because initial config is working for some time without changes.