View source for IKEv2 EAP between NordVPN and RouterOS

{{Versions | v6.45.2 +}}

Starting from RouterOS v6.45, it is possible to establish IKEv2 secured tunnel to NordVPN servers using EAP authentication. This manual page explains how to configure it.

[[file:Ikev2-rw-nordvpn.png]]

==Installing the root CA==

Start off by downloading and importing the NordVPN root CA certificate.

<pre>
/tool fetch url="https://downloads.nordvpn.com/certificates/root.der"
/certificate import file-name=root.der
</pre>

There should now be the trusted NordVPN Root CA certificate in [[M:System/Certificates | System/Certificates]] menu.

<pre>
[admin@MikroTik] > /certificate print where name~"root.der"
Flags: K - private-key, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted 
 #         NAME            COMMON-NAME            SUBJECT-ALT-NAME                                         FINGERPRINT           
 0       T root.der_0      NordVPN Root CA                                                                 8b5a495db498a6c2c8c...
</pre>

==Finding out the server's hostname==

Navigate to https://nordvpn.com/servers/tools/ and find out the recommended server's hostname. In this case it is lv20.nordvpn.com.

[[file:Nordvpn_hostname.png]]

==Setting up the IPsec tunnel==

It is advised to create a separate Phase 1 [[M:IP/IPsec#Profiles | profile]] and Phase 2 [[M:IP/IPsec#Proposals | proposal]] configurations to not interfere with any existing or future IPsec configuration.

<pre>
/ip ipsec profile
add name=NordVPN
/ip ipsec proposal
add name=NordVPN pfs-group=none
</pre>

While it is possible to use the default [[M:IP/IPsec#Policies | policy]] template for policy generation, it is better to create a new policy [[M:IP/IPsec#Groups | group]] and template to separate this configuration from any other IPsec configuration.

<pre>
/ip ipsec policy group
add name=NordVPN
/ip ipsec policy
add dst-address=0.0.0.0/0 group=NordVPN proposal=NordVPN src-address=0.0.0.0/0 template=yes
</pre>

Create a new [[#Mode_configs | mode config]] entry with <var>responder=no</var> that will request configuration parameters from the server.

<pre>
/ip ipsec mode-config
add name=NordVPN responder=no
</pre>

Lastly, create [[M:IP/IPsec#Peers | peer]] and [[M:IP/IPsec#Identities | identity]] configurations. Specify your NordVPN credentials in username and password parameters.

<pre>
/ip ipsec peer
add address=lv20.nordvpn.com exchange-mode=ike2 name=NordVPN profile=NordVPN
/ip ipsec identity
add auth-method=eap certificate="" eap-methods=eap-mschapv2 generate-policy=port-strict mode-config=NordVPN peer=NordVPN policy-template-group=NordVPN username=support@mikrotik.com password=secret
</pre>

Verify that the connection is successfully established.

<pre>
/ip ipsec
active-peers print
installed-sa print
</pre>

==Choosing what to send over the tunnel==

If we look at the generated dynamic [[M:IP/IPsec#Policies | policies]], we see that only traffic with a specific (received by [[M:IP/IPsec#Mode_configs | mode config]]) source address will be sent through the tunnel. But a router in most cases will need to route a specific device or network through the tunnel. In such case we can use source NAT to change the source address of packets to match the mode config address. Since the mode config address is dynamic, it is impossible to create static source NAT rule. In RouterOS it is possible to generate dynamic source NAT rules for mode config clients.

===Option 1: Sending all traffic over the tunnel===

In this example, we have a local network 10.5.8.0/24 behind the router and we want all traffic from this network to be sent over the tunnel. First of all, we have to make a new [[M:IP/Firewall/Address_list | IP/Firewall/Address list]] which consists of our local network.

<pre>
/ip firewall address-list
add address=10.5.8.0/24 list=local
</pre>

It is also possible to specify only single hosts from which all traffic will be sent over the tunnel. Example:

<pre>
/ip firewall address-list
add address=10.5.8.120 list=local
add address=10.5.8.23 list=local
</pre>

When it is done, we can assign newly created [[M:IP/Firewall/Address_list | IP/Firewall/Address list]] to [[M:IP/IPsec#Mode_configs | mode config]] configuration.

<pre>
/ip ipsec mode-config
set [ find name=NordVPN ] src-address-list=local
</pre>

Verify correct source NAT rule is dynamically generated when the tunnel is established.

<pre>
[admin@MikroTik] > /ip firewall nat print 
Flags: X - disabled, I - invalid, D - dynamic 
 0  D ;;; ipsec mode-config
      chain=srcnat action=src-nat to-addresses=192.168.77.254 src-address-list=local dst-address-list=!local
</pre>

{{Warning | Make sure dynamic [[M:IP/IPsec#Mode_configs | mode config]] address is not a part of local network. }}
{{ Note | It is also possible to combine both options (1 and 2) to allow access to specific addresses only for specific local addresses/networks }}

===Option 2: Accessing certain addresses over the tunnel===

It is also possible to send only specific traffic over the tunnel by using the <var>connection-mark</var> parameter in [[M:IP/Firewall/Mangle | Mangle firewall]]. It works similarly as Option 1 - a dynamic NAT rule is generated based on configured <var>connection-mark</var> parameter under [[M:IP/IPsec#Mode_configs | mode config]].

First of all, set the <var>connection-mark</var> under your mode config configuration.

<pre>
/ip ipsec mode-config
set [ find name=NordVPN ] connection-mark=NordVPN
</pre>

When it is done, a NAT rule is generated with the dynamic address provided by the server:

<pre>
[admin@MikroTik] > /ip firewall nat print 
Flags: X - disabled, I - invalid, D - dynamic 
 0  D ;;; ipsec mode-config
      chain=srcnat action=src-nat to-addresses=192.168.77.254 connection-mark=NordVPN 
</pre>

After that, it is possible to apply this <var>connection-mark</var> to any traffic using [[M:IP/Firewall/Mangle | Mangle firewall]]. In this example, access to mikrotik.com and 8.8.8.8 is granted over the tunnel.

Create a new address list:

<pre>
/ip firewall address-list
add address=mikrotik.com list=VPN
add address=8.8.8.8 list=VPN
</pre>

Apply <var>connection-mark</var> to traffic matching the created address list:

<pre>
/ip firewall mangle
add action=mark-connection chain=prerouting dst-address-list=VPN new-connection-mark=NordVPN passthrough=yes
</pre>

{{ Note | It is also possible to combine both options (1 and 2) to allow access to specific addresses only for specific local addresses/networks }}

{{cont}}