I am trying to troubleshoot a troublesome issue with a NordVPN on my Hex S (software version v6.49.7)
I am using the fairly tried and tested config that sends all traffic behind the Mikrotik over the VPN, plus the killswitch/blackhole config. This has been in place for a while, but occasionally (though can sometimes be several times in a short burst) traffic will stop passing until I flush the SAs (or reboot!). There is no clear trend or trigger, and it's not after a set amount of time. Sometimes I can go all day and have no problem, other times I have to literally keep a console window open to flush SAs as it's so unstable
My IPSEC/mangle config is as follows
Code: Select all
/ip ipsec mode-config
add name=NordVPN responder=no src-address-list=local
/ip ipsec policy group
add name=NordVPN
/ip ipsec profile
add enc-algorithm=aes-128 hash-algorithm=sha256 name=NordVPN
/ip ipsec peer
add address=xxxxx.nordvpn.com exchange-mode=ike2 name=NordVPN profile=NordVPN
/ip ipsec proposal
set [ find default=yes ] disabled=yes
add auth-algorithms=sha256 name=NordVPN pfs-group=none
/ip firewall address-list
add address=192.168.88.0/24 list=local
add address=192.168.88.2-192.168.88.254 list=local-range
/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related \
disabled=yes
/ip firewall mangle
add action=mark-connection chain=forward ipsec-policy=out,ipsec new-connection-mark=ipsec
add action=mark-connection chain=forward ipsec-policy=in,ipsec new-connection-mark=ipsec
add action=mark-routing chain=prerouting new-routing-mark=via-vpn passthrough=yes src-address-list=local
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes ipsec-policy=out,none \
out-interface-list=WAN
/ip ipsec identity
add auth-method=eap certificate=root.der_0 eap-methods=eap-mschapv2 generate-policy=port-strict mode-config=NordVPN \
peer=NordVPN policy-template-group=NordVPN username=xxxxxxxxxxx
/ip ipsec policy
set 0 disabled=yes
add action=none dst-address=192.168.88.0/24 src-address=0.0.0.0/0
add disabled=yes dst-address=0.0.0.0/0 group=NordVPN proposal=NordVPN src-address=0.0.0.0/0 template=yes
add dst-address=0.0.0.0/0 group=NordVPN proposal=NordVPN src-address=0.0.0.0/0 template=yes
/ip route
add distance=1 gateway=blackhole routing-mark=via-vpn
Using ping tool, I notice that if the VPN drops, pings will fail, but the ping tool itself does not let me run any action or script. I did find a thread about this topic and a ping script but I could not seem to get it to run. Example the last comment here seems to be my experience too: viewtopic.php?p=587765 and also here: viewtopic.php?p=587528
Can I test scripts via console first? That's not something I have tried before (eg I can't see a way to see the output of the script as its ran)
I tried using Netwatch, but oddly when the VPN is down, pings still succeed, and I don't see a way to make sure that traffic goes over the VPN
The idea for the above to points being to flush SAs when pings fail.
- Are there any crypto settings I could try differently?
- Are there any specific log lines that may help? I tried adding IPSEC to the logs but there did not seem to be anything obvious/incriminating when an issue occurs.
- I am happy to flush ALL SAs because this device only has a single tunnel for all traffic, so any wider impact is not a concern here as it would be for others
I understand I could leverage Wireguard, but that is a significant upgrade with a new learning curve entirely (and my existing config will not directly port to V7 so I can't have like for like without more research and testing). The hardware accelleration on the Hex S (the main reason I bought it to upgrade my old hAP Lite) makes performance very good, however there is a stability issue with my current config.
As this is acting purely as a VPN client, there's no 'other end' device for me to troubleshoot, but I do note that my config differs slightly from the current Nord guide here: https://support.nordvpn.com/Connectivit ... ordVPN.htm - Namely I note they don't boost the crypto like I have
Many Thanks in advance!
