VPN config - stopped working.

RouterOS Beginner Basics
1

Hello,

i’ve configured my Mikrotik to use NordVPN, i’ve use this tutorial https://wiki.mikrotik.com/wiki/IKEv2_EAP_between_NordVPN_and_RouterOS.
Everything was working properly but i’ve realised that i need to push some traffic without VPN (Netlifx didnt work). If I good rememer the only change ive done was adding another address-list to firewall. Next day i cant browse internet. Ping from my PC works properly (trying 8.8.8.8 and google.com), the same from router, but websites didnt load. I’ve deleted all IPSec settings, add nat rule and it works again. When ive tried to set up Nord again my problems returns. What’s wrong? How can I set IP or IP’s not to use VPN?

/interface bridge
add name=LAN
/interface list
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec mode-config
add name=NordVPN responder=no src-address-list=pula_VPN
/ip ipsec policy group
add name=NordVPN
/ip ipsec profile
add name=NordVPN
/ip ipsec peer
add address=XXX.nordvpn.com exchange-mode=ike2 name=NordVPN profile=NordVPN
/ip ipsec proposal
add name=NordVPN pfs-group=none
/ip pool
add name=Pula_DHCP ranges=192.168.1.2-192.168.1.100
/ip dhcp-server
add address-pool=Pula_DHCP disabled=no interface=LAN lease-time=6m name=DHCP
/interface list member
add interface=ether1 list=WAN
add interface=LAN
/ip address
add address=192.168.1.1/24 interface=ether2 network=192.168.1.0
/ip dhcp-client
add disabled=no interface=ether1 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall address-list
add address=192.168.1.0/24 list=pula_VPN
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip ipsec identity
add auth-method=eap certificate="" eap-methods=eap-mschapv2 generate-policy=\
    port-strict mode-config=NordVPN password=\
    XXX peer=NordVPN \
    policy-template-group=NordVPN username=XXX
/ip ipsec policy
add dst-address=0.0.0.0/0 group=NordVPN proposal=NordVPN src-address=\
    0.0.0.0/0 template=yes

Greetings Kdt

2

They have many servers, some of them gets DDOS’ed, some of them get’s reconfigured or decommissioned. You likely need to switch to any other server.

I’ve written more complete guide for NordVPN because some steps were missing in official guides: http://forum.mikrotik.com/t/nordvpn-ipsec-ikev2-killswitch-for-ros6/144817/1

3

Thx erkexzcx for answer,

My latest config

/interface bridge
add name=BR_LAN protocol-mode=none
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=LAN_DYNAMIC ranges=192.168.1.101-192.168.1.120
/ip dhcp-server
add address-pool=LAN_DYNAMIC disabled=no interface=BR_LAN name=DHCP_LAN
/interface bridge port
add bridge=BR_LAN interface=ether2
add bridge=BR_LAN interface=ether3
add bridge=BR_LAN interface=ether4
add bridge=BR_LAN interface=ether5
add bridge=BR_LAN interface=ether6
add bridge=BR_LAN interface=ether7
add bridge=BR_LAN interface=ether8
add bridge=BR_LAN interface=ether9
/ip address
add address=192.168.1.1/24 interface=BR_LAN network=192.168.1.0
/ip dhcp-client
add disabled=no interface=ether1 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 \
    netmask=24
/ip dns
set allow-remote-requests=yes servers=1.1.1.1

/ip firewall address-list
add address=192.168.1.0/24 list=UNDER_VPN

/ip ipsec mode-config
add name=NordVPN responder=no src-address-list=UNDER_VPN
/ip ipsec policy group
add name=NordVPN
/ip ipsec profile
add dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha512 name=\
    NordVPN
/ip ipsec peer
add address=xxxxx.nordvpn.com exchange-mode=ike2 name=NordVPN profile=NordVPN
/ip ipsec proposal
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc lifetime=0s name=\
    NordVPN pfs-group=none
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1 src-address=\
    192.168.1.0/24
/ip ipsec identity
add auth-method=eap certificate=NordVPN_cert eap-methods=eap-mschapv2 \
    generate-policy=port-strict mode-config=NordVPN password=\
    peer=NordVPN policy-template-group=NordVPN \
    username=
/ip ipsec policy
add dst-address=0.0.0.0/0 group=NordVPN proposal=NordVPN src-address=\
    0.0.0.0/0 template=yes

Did almost eveything like in your tutorial (which is almsot the same like on nordvpn and miktorik sites).
Still can’t connect web using VPN.

MT log:

new ike2 SA (I): 192.168.2.94
peer authorized: 192.168.2.94
EAP authorized: 192.168.2.94

So logged in VPN service.

NAT

In NAT rules order on screen can’t connect websites, if i change it, websites work properly.
Ping from router and PC to 1.1.1.1 works fine, even if websites doesn’t work.