Ik ben erin geslaagd om een IKEv2-verbinding op te zetten naar WindScribe Nederland en het NPO-verkeer op basis van de IP-range door die tunnel te sturen. Helaas ziet NPO op de een of andere manier nog steeds dat ik niet vanuit Nederland verbind.
Als ik dezelfde inloggegevens gebruik om een IKEv2-verbinding vanaf mijn Windows-bak in te stellen, lukt het wél.
Onderstaande code is gebaseerd op Windscribe VPN on Mikrotik waarbij verwezen wordt naar NordVPN (IPSEC/IKEv2) + killswitch (For ROS6) (use-case #2).
Code: Selecteer alles
# Get and import certificate: WindScribe is using Let's Encrypt
/tool fetch url="https://letsencrypt.org/certs/isrgrootx1.pem"
/tool fetch url="https://letsencrypt.org/certs/lets-encrypt-r3.pem"
/certificate import file-name=isrgrootx1.pem passphrase=""
/certificate import file-name=lets-encrypt-r3.pem passphrase=""
# Mark traffic that you want to route through VPN server
/ip firewall address-list add address=145.58.0.0/16 list=under_windscribe_nl
/ip firewall mangle add action=mark-connection chain=prerouting dst-address-list=under_windscribe_nl new-connection-mark=under_windscribe_nl passthrough=yes
# IPsec/IKEv2 configuration
/ip ipsec mode-config add connection-mark=under_windscribe_nl name="WindScribe NL mode config" responder=no use-responder-dns=no
/ip ipsec policy group add name="WindScribe NL"
/ip ipsec profile add dh-group=ecp384 enc-algorithm=aes-256,aes-192,aes-128 hash-algorithm=sha256 name="WindScribe NL profile" proposal-check=strict
/ip ipsec peer add address=nl.windscribe.com exchange-mode=ike2 name="WindScribe NL server" profile="WindScribe NL profile"
/ip ipsec proposal add auth-algorithms=sha256 name="WindScribe NL proposal" pfs-group=ecp384
/ip ipsec identity add auth-method=eap certificate=lets-encrypt-r3.pem_0 eap-methods=eap-mschapv2 generate-policy=port-strict mode-config="WindScribe NL mode config" peer="WindScribe NL server" policy-template-group="WindScribe NL" remote-id=fqdn:nl.windscribe.com username=*** password=***
/ip ipsec policy add dst-address=0.0.0.0/0 group="WindScribe NL" proposal="WindScribe NL proposal" src-address=0.0.0.0/0 template=yes
# In "/ip ipsec policy" you should be able to see a new dynamic rule added next to your WindScribe NL policy. It MUST exist, otherwise configuration is not working.
# (OPTIONAL) Implement a killswitch
/interface bridge add name=windscribe_nl_blackhole protocol-mode=none
/ip route add gateway=windscribe_nl_blackhole routing-mark=windscribe_nl_blackhole
/ip firewall mangle add chain=prerouting dst-address-list=under_windscribe_nl action=mark-routing new-routing-mark=windscribe_nl_blackhole passthrough=yes
# Exclude such VPN traffic from fasttrack
/ip firewall filter add action=accept chain=forward connection-mark=under_windscribe_nl place-before=[find where action=fasttrack-connection]
# Reduce MSS (should be about 1200 to 1400, but 1360 worked for me)
/ip firewall mangle add action=change-mss chain=forward new-mss=1360 passthrough=yes protocol=tcp connection-mark=under_windscribe_nl tcp-flags=syn tcp-mss=!0-1360
Ik vermoed dat het iets kleins is dat misgaat, maar ik kan er de vinger niet op leggen.
Zie jij de vaut? Dan hoor ik het graag.
