MikroTik TOC docucmentation: wiki.mikrotik.com/wiki/IKEv2_EAP_between_NordVPN_and_RouterOS Steps to setup VPN tunnel: Install Security Certificate /tool fetch url="downloads.nordvpn.com/certificates/root.der" /certificate import file-name=root.der Find NordVPN servers nordvpn.com/servers/tools/ Configure IKE2 Tunnel /ip ipsec mode-config add name=NordVPN responder=no src-address-list=NordVPN-Local /ip ipsec policy group add name=NordVPN /ip ipsec profile add name=NordVPN /ip ipsec peer add address=uk2065.nordvpn.com exchange-mode=ike2 name=NordVPN profile=NordVPN /ip ipsec proposal add name=NordVPN pfs-group=none /ip ipsec identity add auth-method=eap certificate="" eap-methods=eap-mschapv2 generate-policy=port-strict mode-config=NordVPN password=YOURPASSWORD peer=NordVPN policy-template-group=NordVPN username=YOURUSERNAME /ip ipsec policy add dst-address=0.0.0.0/0 group=NordVPN src-address=0.0.0.0/0 template=yes Configure Sources to leave via IPSEC /ip firewall address-list add address=YOURNETWORKS list=NordVPN-Local If you encounter strange ICMP issues from devices like TVs/Playstations try creating an additional policy with your LAN subnet Make sure this is below your default policy, but above dynamiclly created policies /ip ipsec policy add action=none dst-address=YOURNETWORK src-address=0.0.0.0/0
@GrumpyMonkee
2 жыл бұрын
Thank you for this tutorial, easy to understand and follow. I've had to add the additional ipsec policy and I do it's below the default and above the dynamic policy. I've noticed sometimes that it changes though and will suddenly be at the bottom. Is there a way to ensure it always remains above the dynamic one?
@gianpiero241982
Жыл бұрын
Hi, is it possible to apply this configuration to a Mikrotik RouterBoard on cascading ISP router?
@eroloner5125
2 жыл бұрын
For those with the connection "flashing" in "Active Peers", just install the NordVPN certificate. /tool fetch url="downloads.nordcdn.com/certificates/root.der" then /certificate import file-name=root.der. support.nordvpn.com/Connectivity/Router/1360295132/MikroTik-IKEv2-setup-with-NordVPN.htm
@blindside995
2 жыл бұрын
You’re videos are incredibly high quality. Content is presented in such a professional way. I haven’t finished your MTCNA list of videos, but each of them so far have been fun to watch and learn alongside. Thank you for taking us on this journey with you! Keep of the great work hope you have a nice day.
@TheNetworkBerg
2 жыл бұрын
Thank you for your nice feedback and being a long time viewer and subscriber, I appreciate it a lot Landon!
@totemimaging
Жыл бұрын
Fantastic - this is exactly what was needed! Your walkthrough is so well done and consequently very easy to follow. Thanks a lot!
@marioh5172
2 жыл бұрын
Some comments: 1. While adding your ipsec policy (7:12), you have selected the wrong proposal "default". What this means is that you will see every 30 minutes ipsec rekey errors and your tunnel will not be stable because your "default" proposal most likely includes pfs-group=modp1024. /ip ipsec policy add dst-address=0.0.0.0/0 group=NordVPN proposal="NordVPN" src-address=0.0.0.0/0 template=yes 2. You haven't fetched and imported the certificate at all and consequently not referenced it in the identities. Why? /tool fetch url="downloads.nordcdn.com/certificates/root.der" /certificate import file-name=root.der name="NordVPN CA" passphrase="" "Extra rules" not disclosed in this video could be: /ip firewall filter add action=accept chain=forward connection-mark=NordVPN-Local place-before=[find where action=fasttrack-connection] comment="Exclude VPN traffic from fasttrack"
@MohsinAli-kc5fr
Жыл бұрын
you have saved me from lot of hectic after commenting this.. such a helpful thing this is ..
@andrewlee4197
5 ай бұрын
@@MohsinAli-kc5fr Thank you this worked and save tons of time
@porcuzburator8778
2 ай бұрын
God bless you, man!
@ghailenbenothman761
10 ай бұрын
Thank you soo much for the video. its exactly what somany new Mikrotik users needed. One quick question most of uare still having very slow or unstable connection with the VPN connection. Fasttrack disabling didn't do much. can you make a short video showing us what can be done in this case please. Thank you :)
@MauriF76
2 жыл бұрын
You’re the number 1!! Thank You very much!!
@bartellemy9955
11 ай бұрын
Nice vid, informative, need to also hop your dns onto VPN too tho
@heinkruger8123
2 жыл бұрын
Thanks dude! Altyd lekker om n Suid Afrikaanse stem op youtube tevind!
@TheNetworkBerg
2 жыл бұрын
Lekker man, daar is baie Suid Afrikaners wat na die KZitem videos kyk so dit maak my baie bly om te sien hoeveel van ons in MikroTik is :D!
@willberry23
2 жыл бұрын
Great video. I got near the end and when adding the identity for nordvpn, it did not allow me to add the ipsec identity. The message also states username not set. Any ideas how to get passed this?
@addip
2 жыл бұрын
Same here, any idea why?
@tibuuso
2 жыл бұрын
We need your tutorial on NordLynx using Mikrotik
@adeem.mughal
2 жыл бұрын
Hi. I'm new with Mikrotik Device. I have recently configured Mikrotik 750GR3 and have successfully configured PPPOE. Everything is working good and we have also assigned users with their speed limits which is working fine. Now the problem is, when we connect with NordVPN or any third party VPN, the Dialup connection gets disconnected and there isn't any internet on the PC. Again we have to connect the Dialup connection and second time the connection is established, VPN connected but no Internet connectivity (no browsing). Can you please help me out? On Wifi, users are using NordVPN without any issue.
@gewrgioschatzinikitas7509
2 жыл бұрын
He cant answeer you. He is just a idiot showing a video sawn by another 1000 idiots. When it comes to problems. Nobody is here.
@jermainebrown8615
2 жыл бұрын
Do a wireguard video for router os7
@TechnoDoggy
2 жыл бұрын
Would be cool if NordVPN allows for the Wireguard protocol to connect like this
@tcc5750
2 жыл бұрын
Agreed, Wireguard client like pfSense on MikroTik would be nice. Even Ubiquiti has ways of doing this.
@civicvti8383
2 жыл бұрын
Great Video, Hope you can create a setup video for nordlynx (wireguard) on Mikrotik router. Thanks
@Hanesy
2 жыл бұрын
i appreciate your work sir. Next video how to exclude a specific ip or computer please
@Techamooz
Жыл бұрын
Thanks a lot. I have a Mikrotik VPS. I wanted to connect to my mikrotik through L2tp vpn and get the IP of the NordVPN but I could not do that. I always get the IP of the Mikrotik server.
@ThePROJECTKB
9 ай бұрын
Thank you - Where would i put the dedicated IP?
@Sam-u4r3u
Жыл бұрын
I find that when vpn is not connected, local isp route is used instead - how to restrict that only nordvpn connection is used to supply internet and when that is not connected (NordVPN) no internet is offered to devices
@kingzback
2 жыл бұрын
Great video! same settings in case i have a RB750Gr3 connected with a draytek modem? i have to vpn only the devices connected to the mikrotik. thank you!
@anvara.816
11 ай бұрын
I did everything like you mentioned. But I am not able to connect and I am not seeing active peers.
@Jelisejus
10 ай бұрын
Same here :(
@anvara.816
10 ай бұрын
@@Jelisejusi checked the reason, the certificate of nordvpn is not relible. Did not find anything that can prevent that. Aftrwards, tried openvpn was working.
@Jelisejus
10 ай бұрын
@@anvara.816, thanks for your answer! Does this mean that the Nord VPN can't be used any more?
@anvara.816
10 ай бұрын
@@Jelisejusi did not understand it. The documentation showing me the certifocate, however this cert is mentioning by the system as irreliable. I believe that we need to get in touch with nordvpn support.
@Jelisejus
10 ай бұрын
@@anvara.816, please let me know the answer from NordVPN if you decide to get in touch with them. Thank you in advance 🤝👍
@instkoff
2 жыл бұрын
Hi, I did everything according to the instructions, the connection is established, but after a few seconds the error "eap timeout", what does it mean?
@liamtimm8903
2 жыл бұрын
in ipsec policy under Action change default proposal to NordVPN
@KDANSO-sx5hr
6 ай бұрын
Getting winbox error couldn't add new IPsec identity. username not set (6).. any help
@juraj.karoly
Жыл бұрын
Hello Network Berk, it would be helpful for me, if I know what is the configuration of the Mikrotik device when you start configuring the NordVPN (5:31). Is it the default Mikrotik configuration? Like if I would reset my Mikrotik (RB951G-2HnD)? Thanks.
@josepharueyingho9417
2 жыл бұрын
sir, I follow all your instructions but noticed that on the active peer, mine keeps going off and on, what could be the cause?
@gerriem100
2 жыл бұрын
I followed this video but the IPSec dropped connection after a fiew secconds. After i installed te nordVPN cetificate (see mikrotik nordvpn wiki) the connection was stable
@PsykoFero
2 жыл бұрын
This helped alot thanks!!
@lediopretusha4537
Жыл бұрын
Hey man. I followed you tutorial but at the part when you cut the video I have a problem. Can you give me an advise on what to do?
@crash939burn
2 жыл бұрын
just want to know if i should still add the NordVPN root certificate and where, as they state to import it via terminal.
@luisavila6356
2 жыл бұрын
hello, i did exactly what yo did in the video, but u have problem using netflix and amazon prime in my roku and smart tv its says there is a internet problem!
@TheNetworkBerg
2 жыл бұрын
Hello, I can only really suggest trying to connect to another server. It is not uncommon for CDNs to block VPN sourced IPs. If that fails please try setup from scratch following this guide word for word: wiki.mikrotik.com/wiki/IKEv2_EAP_between_NordVPN_and_RouterOS If that also doesn't work you may have to discuss it directly with MikroTik/NordVPN/Your ISP.
@abeydagnew9222
Жыл бұрын
Why do I loose all my speed after connecting my Mikrotic with Nord von to network switch and get from switch? But directly from switch is perfect.
@andrewlee4197
5 ай бұрын
Had the same issue but after adding follow firewall rule form @marioh5172 issue is fixed "Extra rules" not disclosed in this video could be: /ip firewall filter add action=accept chain=forward connection-mark=NordVPN-Local place-before=[find where action=fasttrack-connection] comment="Exclude VPN traffic from fasttrack"
@mrrtee1343
5 ай бұрын
Can we setup more server to the same ip location? i.e i want to have more US ip with this vpn config in mikrotik
@ivanbunsha5585
2 жыл бұрын
Thanks for video. Please i need your help. is it possible to connect to nordvpn only wlan interface? Thanks
@marjoni
2 жыл бұрын
good job
@cedcano
Жыл бұрын
Hi, thanks for the tutorial, I followed all the steps but saw no , what could the problem be? I see that os7 support Wireguard, did you uploaded a tutorial from Wireguard to NordVpn on a mikrotik?
@Womble1978
6 ай бұрын
same here no active peers shown
@luisqp66
2 жыл бұрын
What mikrotik hardware is best for vpn in a home environment ? Do we need rb4011 or hex s is enough?
@pencuriinshaf8822
Жыл бұрын
What about the nat? Should i nat my isp gateway or nat only dinamic nordvpn
@bhairlines5375
2 жыл бұрын
thank you very much for your tutorial...but when i turn on firewall losing speed internet cant open anything...please help to solve this problem...need to hide finaly my public ip but want to be able to watch tv...
@TheNetworkBerg
2 жыл бұрын
Hello, with any type of traffic encryption you will sacrifice some speed for that, though it shouldn't be that bad that you cannot stream services. I am not experiencing speed issues and I am able to stream from Netflix UK at 4K. Have you tried connecting to a different server? Can you export all your config related to the VPN? You could also try what I posted in the pinned comment: "If you encounter strange ICMP issues from devices like TVs/Playstations try creating an additional policy with your LAN subnet Make sure this is below your default policy, but above dynamically created policies /ip ipsec policy add action=none dst-address=YOURNETWORK src-address=0.0.0.0/0"
@BarryVanWyk007
2 жыл бұрын
Hi. Can you do one with palo alto IPsec?
@nikolashuminosky6987
2 жыл бұрын
is that features src address list, works between two mt?
@zvioveku4522
2 жыл бұрын
Thanks... that helped a lot, I liked your detailed explanation)) If you'll have time maybe only you could help :)) can't find solution anywhere I have IPSEC IKEv2 connection between my mikrotik and Nordvpn to a multiple geo locations. 1) I want to restrict specific website connection without vpn, how can I achieve to have mangle of vpn only packets? As I see IPSEC does not create any new interface or route (only tunnel ip route). I have list of my computers and vpn needed websites. 2) As I said, I have several vpns to different location, how can I prioritize which must be first and which second? I want to have failover situation, as I see, It somehow prioritizes the main route (also wonder how? ms distance?) and when multiple vpns are up, it jumps to another one when main vpn disconnects. I want to specify that first main route which should be used.
@Rafa-jp5yy
2 жыл бұрын
Hi, did you find solution?
@laicheeeeee
2 жыл бұрын
hi buddy! great video! any chance you know what this error message is: unable to get local issuer certificate at depth: 0 SubjectName: /CN=rw1-client can't verify peer's certificate from store
@CheekyMiner
4 ай бұрын
What if you have a PPPoe WAN connection, does this still work?
@porcuzburator8778
2 ай бұрын
yes, it does
@josepharueyingho9417
2 жыл бұрын
Sir, I don't know after performing all the actions on the IPsec.. on the identity after putting in all details for that section it says could not add new IPsec Identity- username not set (6) although I'm using hAp lite series, smips can anyone help?
@Ruasha76
2 жыл бұрын
I am trying to set up my mikrotik to use with ExpressVPN, and I am getting the same error. i don't even know if ExpressVPN will work, I just figure I would try, but cant get past this identity step..
@chriszoladube454
2 жыл бұрын
I have followed every step, nothing shows on the “active peers” and installed SAs
@vytautaspaulauskas5872
Жыл бұрын
same here
@peymantrue
2 жыл бұрын
Perfect
@biki1973
2 жыл бұрын
do you need to open ports 500 and 4500 on your mikrotik for ipsec to work? how is it done on the other side? they don't know your ip if you have dynamic one. doesn't ipsec require both ends to know ip of the other end?
@TheNetworkBerg
2 жыл бұрын
There is nothing required from NordVPN's side besides the server you want to connect to and your username and password. Their service is essentially setup as a dial-up service. Where you establish the IPSEC connection via IKEv2 with EAP. If the remote server (Nord) verifies your details are correct it basically just creates a dynamic tunnel from NordVPN to accept the connection with the relevant IPSEC parameters on whatever IP address you are coming from. As long as your policies etc are correct. Think of this as a one way configuration where you just need to setup your side. This is really just for secure browsing or that weird Netflix trick I was mentioning, I know a few people use NordVPN on their computers directly. This just allows you to apply it to a router and then you can have your entire network route out via the IPSEC if you choose to so that you don't need to run multiple applications off of different devices or some devices that do not support custom apps but have network functionality.
@pbrigham
2 жыл бұрын
I know is new, but when you can please make a video on ZeroTier, they work now with Mikrotik. Unfortunately, I think is only for version 7 OS.
@TheNetworkBerg
2 жыл бұрын
Hi Pedro, I can check if I can setup a lab. If I can then I will definitely make a video on it :)
@allogic
2 жыл бұрын
Are there no firewall rules required?
@bocahrewelmancing3804
2 жыл бұрын
Good good friend 👍🙏
@chriszoladube408
2 жыл бұрын
I followed every step, but my tunnel does not work, When i go to view active peers, nothing shows, it just flashes, same as ïnstalled SAs. Any idea what i did wrong?
@chriszoladube408
2 жыл бұрын
It seems unstable every 2 seconds.
@TheNetworkBerg
2 жыл бұрын
That typically is an incorrect username/password that has been used. Please make sure to log into your Nord VPN account and get the details from there. It is not your email address and password to log into Nord VPN with (Mistake most people make)
@chriszoladube454
2 жыл бұрын
I have tried this configuration for some time now, it still doesn’t work. Would you have time to remote connect and assist me?
@shamindanishan1
2 жыл бұрын
hi the active peer just comes and goes. what can be the reason?
@TheNetworkBerg
2 жыл бұрын
You could be using the incorrect authentication details.
@shamindanishan1
2 жыл бұрын
@@TheNetworkBerg yes it was resolved and working fine. appreciate your support and the lovely content. keep posting. best wishes.
@harryp8456
2 жыл бұрын
thanks for video, I followed all I got up and running the VPN tunnel but is not 100% fine my upload speed is zero some of the websites are loading long, or doesn't I'm having issues logging in to my Gmail, etc.. to you have any tips, please? Router RB5009UG fast track disable running on lasted version. thanks for any think
@lukastrna
2 жыл бұрын
I have the same problem. Did you find a solution?
@harryp8456
2 жыл бұрын
@@lukastrna no I didn't but I did send email to MicroTik with supout.rif file they did respond that they can't find any thing that can drop VPN traffic. Reply didn't help but I'll share that information anyway.
@JaZzDeOliveira
2 жыл бұрын
Any suggestions on how to speed up the connection? I have set the VPN to use the same country that I am in , I have 100Mb fibre but I can only get about 30Mb on a speedtest
@TheNetworkBerg
2 жыл бұрын
Hmmmmmm, I think it's almost normal to expect some decrease in speed for traffic that is encrypted/decrypted via IPSEC, though a 70% speed loss seems a bit excessive. What you could try and do is something I did in the pinned comment: "If you encounter strange ICMP issues from devices like TVs/Playstations try creating an additional policy with your LAN subnet Make sure this is below your default policy, but above dynamiclly created policies /ip ipsec policy add action=none dst-address=YOURNETWORK src-address=0.0.0.0/0"
@JaZzDeOliveira
2 жыл бұрын
@@TheNetworkBerg thank you , will give that a try
@0RespectMyAuthority0
2 жыл бұрын
I get active peers but web browsing doesnt work
@TheNetworkBerg
2 жыл бұрын
There could be plenty of reasons why your browsing doesn't work. 1) Incorrect configuration, specifically networks not added that you want to route across the tunnel 2) Firewall Rules are blocking traffic or Fasttrack is enabled and the traffic is not being handed off to the peer 3) Possible DNS issue (check if you can ping IPs, if yes then you need to look at your DNS settings) Other than that I would export your configuration and post it either here or on the MikroTik forums to go over. Make sure you do an export with no-sensitive so that passwords aren't exported.
@ReSpeCteR-1
2 жыл бұрын
Very Good videos. Just one Q? On the config for Nord. I have done this step by step and got the credentials from the Nord page as you did. However, the IPsec does not even start. No log entries that even indicate it's trying to establish. Any advice?
@TheNetworkBerg
2 жыл бұрын
There's a few things that could cause this, I would first suggest looking at your FW rules and checking if Fast track is enabled if yes, try disabling that and see if you can connect then.
@ReSpeCteR-1
2 жыл бұрын
@@TheNetworkBerg Thanks for the response. It turned out to be a DNS issue as the router. It was not able to resolve the server name. Added static entry on DNS. Now I have a different issue. I am getting attempts to the Nord server. But it times out on IKE2. I have checked credentials and am 100% sure they are good. I am so close.
@jean-christophepernet9830
2 жыл бұрын
@@ReSpeCteR-1 I had the same problem. You have to install NordVPN's certificate and activate it in "Identities".
@jean-christophepernet9830
2 жыл бұрын
Oh! And also make sure the Lifetime is set in Proposals.
@selahattinoguzcan4073
2 жыл бұрын
Mr Berg I need your help on my mikrotik router. I could not find any video how to enable ports.Only one WAN and LAN ports are working. Is that the solution bridge the ports or VLAN, pls help🙏
@AlirezaNikyar
Жыл бұрын
Can ExpressVPN be used in Mikrotik?
@TheNetworkBerg
Жыл бұрын
Possibly, will have to check, but if it uses Wireguard/OpenVPN then it becomes highly likely.
@juanolivier8537
2 жыл бұрын
Would this tunnel config work on expressvpn too?
@TheNetworkBerg
2 жыл бұрын
Not sure, maybe. Would have to test it out.
@VladimirAbovyan
2 жыл бұрын
hi, dude! I have done exactly what you did, but my peers shows up and goes... and this thing keep going and going. See your comment about - authentication details. If it is login and password from nordvpn acc - they are correct. Any suggestions?
@TheNetworkBerg
2 жыл бұрын
Hello! Thank you for the comment :) The peer typically does that if you are using the incorrect authentication details. Note it is NOT your Nord VPN account and password. You need to log into NordVPN and from there you will find a very long string of characters for the username & password, example is kzitem.info/news/bejne/o2-mtIOshpaYan4 in the video where I show where to get this username and password. Please let me know if that works for you :)
@VladimirAbovyan
2 жыл бұрын
@@TheNetworkBerg, yes as I said I did everything you did. Login and password correct. Any other thoughts?
@TheNetworkBerg
2 жыл бұрын
Hmmmmm not that I can think of that will have the tunnel establish and disconnect the entire time. Maybe some firewall rules? Could try disabling some just to test with and re-enable if it does not fix the issue. Else I would suggest emailing nord VPN support and posting about it on the MikroTik forums as well.
@VladimirAbovyan
2 жыл бұрын
@@TheNetworkBerg, okay, thanks man, i will try.
@franzpavenzinger4478
2 жыл бұрын
Hello Both, Same here. It did work already but since a few days I have the same phenomena. Vladimir do you have anything new?
@1337-coder
25 күн бұрын
not work. you skipped steps...
@nikolashuminosky6987
2 жыл бұрын
is that service free? i mean NotVPN
@TheNetworkBerg
2 жыл бұрын
Hi Nikola, no. NordVPN is a paid for service, you can basically sign up as a trial for the first 30 days and then cancel and get refunded if you aren't happy with the service.
@lukastrna
2 жыл бұрын
Huston, we have a problem. Everything works, but the upload is 0 Mbps. The same problem is described below by @mirek panek. Any idea? A problem with the ISP? Thanks for more videos!
@TheNetworkBerg
2 жыл бұрын
Hmmmmm there are tons of reasons why that could potentially be happening, the guide in the video assumes you have no default configuration or firewall rules in place that can cause potential issues with connectivity. What I can recommend is trying to run this ipsec policy and seeing if that improves anything: /ip ipsec policy add action=none dst-address=YOURNETWORK src-address=0.0.0.0/0 Else I would recommend posting your configuration with all sensitive information hashed out either here or to MikroTik's support.
@teslastorm
2 жыл бұрын
@@TheNetworkBerg I modified the ipsec policy according to your recommendation, but the 0 Mbps upload problem was not solved. I will try to contact Mikrotik support.
@cs19cr
2 жыл бұрын
Great video, thanks! Can I replicate this with Cyberghost and just change the credentials and server info as you did in the video?
@TheNetworkBerg
2 жыл бұрын
I really couldn't say, probably if the encryption is the same. Though you might want to confirm this with Cyberghost's support team.
Пікірлер: 119