Community discussions

MikroTik App
 
electrcblue
just joined
Topic Author
Posts: 3
Joined: Tue Jun 22, 2021 11:39 am

Create a VPN gateway

Tue Jun 22, 2021 11:58 am

Hi guys

I'm trying to keep my NAT to WAN rule working for the default gateway and set up a second gateway from a bridge IP for my VPN.

I do not know how to make the NAT rules distinguish what IP (gateway) the traffic is coming from and masquerade accordingly.
I'd like to use 10.1.1.200%bridge as the VPN gatewayn and keep 10.1.1.100%bridge as the default gateway, but these routes are auto created and I cannot edit them, see attached.

I suspect I need to make the Wireguard NordVPN tunnel (working great) part of the WAN, as the default auto route for 0.0.0.0/0 routes to the WAN? I cannot figure out how to make the NAT rule distinguish which gateway the traffic is coming from and send to correct interface?

Screenshot attached (VPN disabled until I can get this to work :) )

Please let me know if you require more information. Can anyone assist please?
Thanks
You do not have the required permissions to view the files attached to this post.
 
User avatar
erkexzcx
Member Candidate
Member Candidate
Posts: 258
Joined: Mon Oct 07, 2019 11:42 pm

Re: Create a VPN gateway

Tue Jun 22, 2021 6:56 pm

Isn't this what you are basically trying to achieve? viewtopic.php?f=23&t=169273

Regarding routes, I believe you need to use different routing tables. In Mikrotik the functionality can be achieved by using "routing mark" or something like that.

Also there is no need for Wireguard to NordVPN servers, you can use IPSEC/IKE2 instead as most of Mikrotik routers do support hardware acceleration.
Linux <3
 
electrcblue
just joined
Topic Author
Posts: 3
Joined: Tue Jun 22, 2021 11:39 am

Re: Create a VPN gateway

Thu Jun 24, 2021 1:52 pm

Tagging traffic seems over complicated for a simple gateway to a VPN. Split networking working with Wireguard for Windows, so guess that will have to do.

OpenVPN UDP (not supported by Mikrotik) is twice as fast as IKE. Wireguard (UDP) is in beta 7. It's even faster than OpenVPN UDP and connects/reconnects instantly.

You haven't experienced NordVPN unless you try wireguard (it runs 98% the same speed as un-vpn'ed connections. Setup instructions here: https://forum.openwrt.org/t/instruction ... nwrt/89976

Thanks for your reply.
 
electrcblue
just joined
Topic Author
Posts: 3
Joined: Tue Jun 22, 2021 11:39 am

Re: Create a VPN gateway

Fri Jun 25, 2021 2:46 pm

OK this is much simpler in ROS7:

Set a route in the main table to the NordVPN server/32 to use the IP%ethernet1. (just add routes to a list you want to to give access via WAN)
Add a route for 0.0.0.0/0 to use gateway NordVPN (wireguard interface), add this to a new table i.e. main2
New feature in ROS7 routing rules:
Add a routing rule for 0.0.0.0/0 to lookup interface bridge to use table main2. (to mitigate the default added rule to the WAN)

In the event that the tunnel goes down, there's no more default out rule.
I added a firewall rule for In interface Lan with "an allow destination IP list" as an extra leak safeguard.

Have fun with NordVPN Wireguard! The PC version of Wireguard kills 127.0.0.1 (dns etc) and some powershell commands notably Invoke-RestMethod.

Looking forward to the final release of OS7!
 
weldox
just joined
Posts: 14
Joined: Mon Mar 06, 2017 2:35 pm

Re: Create a VPN gateway

Mon Jan 10, 2022 3:04 pm

Hello guys, is there a "final guide" to create NordVPN gateway with mikrotik v7 wireguard?

Thank You very much!
Mauri
 
User avatar
own3r1138
Member
Member
Posts: 392
Joined: Sun Feb 14, 2021 12:33 am
Location: Pleiades
Contact:

Re: Create a VPN gateway

Mon Jan 10, 2022 8:55 pm

"final guide"
already there is some in the forum if you search "nordlynx" you will find it.
You are right, I am wrong
You are wise, I am dumb
You are wrong, you are dumb
Don't worry, it's all right to be dumb
 
weldox
just joined
Posts: 14
Joined: Mon Mar 06, 2017 2:35 pm

Re: Create a VPN gateway

Tue Jan 11, 2022 4:32 pm

I tryied to find something but there is a lot of suggests and some confusion but not a real thread.
It should be really interesting to have a real guide to set mikrotik wireguard for NordVPN
 
danielkit
just joined
Posts: 1
Joined: Wed Jun 02, 2021 4:49 pm

Re: Create a VPN gateway

Thu Jan 20, 2022 3:41 pm

I am able to extract the Nordlynx's private and public key on linux system. But i am not familiar on routing configuraiton. Hope someone can teach me to setup a routing on routeros to route the traffic from apple tv to wireguard vpn. :D :D
 
User avatar
own3r1138
Member
Member
Posts: 392
Joined: Sun Feb 14, 2021 12:33 am
Location: Pleiades
Contact:

Re: Create a VPN gateway

Fri Jan 21, 2022 7:44 pm

You are right, I am wrong
You are wise, I am dumb
You are wrong, you are dumb
Don't worry, it's all right to be dumb
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 11835
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Create a VPN gateway

Fri Jan 21, 2022 11:28 pm

I am able to extract the Nordlynx's private and public key on linux system. But i am not familiar on routing configuraiton. Hope someone can teach me to setup a routing on routeros to route the traffic from apple tv to wireguard vpn. :D :D
Hi Daniel,
This is one way to approach a wireguard setup and it fits most circumstances.
A home connection from MT router to third party vendor should be snap easy.
viewtopic.php?t=182340 The idea is to keep it simple and clean.

The vendor is the server, and your MT acts as a client, to establish the tunnel.
Thus you need to tell the vendor some things................. like the MT public key, the IP address or IP subnet of your devices to put on the Nordlynx allow addresses peer setting.
What you need from the vendor is the listening port of their server and the public IP address or URL dyndns name they provide to go with that.
You need their public key to put in your MT peer settings.
The allowed address you put on your MT peer settings is 0.0.0.0/0
Suggest you put persistent keep alive to something like 30 seconds.

You are pretty much done................ except for one thing.
You need to tell the apple device to go out the wireguard tunnel right.
Lets say apple device is on a subnet and its IP address is 192.168.5.0.10 That is the IP address you needed to give nordlynx for their allowed address peer settings as noted above.

All you need is three steps.
1. Create a table via terminal CLI command:
/routing table add name=useWG fib

2. Create IP route
dst-address=0.0.0.0/0 gwy=wg-interface-name table=useWG

3. Create Route rule:
source address=192.168.50.10
Action=lookup-only-in-table
Table=useWG

Note: if you wanted the apple tv to be able to access the normal MT router internet if the wireguard connection is broken then use --> Action: "lookup" instead.

Done and no need for any other settings on the MT (no need to set IP address for example).
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
MTUNA Certified, by the Ascerbic Llama!

Who is online

Users browsing this forum: Ahrefs [Bot], Semrush [Bot] and 24 guests