12

Day by day the Web censorship in my country gains its strength. The obvious solution is to use VPN, but it slows down the connection and harmlessness of public VPN services can't be guaranteed.

So I thought following solution out:

The router will access most of web sites in a conventional way, but will keep a constant VPN connection which will pretend to be one additional network interface. If I access one of censored web sites, router will pass the traffic through this virtual interface.

Is this possible with RouterOS? How to do that?

My router is RB2011UiAS-2HnD-IN, RouterOS v 6.30.2.

Improve this question
3
  • Actually, this question would be suited for the Network Engineering subsite. They will tell you that what you want cannot be achieved - a connection can either be tunneled or not. It cannot be both. Use a good VPN-Service, straight from your desktop OS, and just turn it on and off as necessary.
    – vic
    Commented Nov 11, 2015 at 17:20
  • 2
    @vic Maybe RouterOS cannot do it, but that does not mean it is impossible. Linux policy routing can get you most of the way there, for instance, though it works on IP/CIDR ranges. But then you have the question of whether you can trust the DNS records you received...
    – Michael Hampton
    Commented Nov 11, 2015 at 18:29
  • 1
    RouterOS can do it fine. Simple one-line iptables rule.
    – qasdfdsaq
    Commented Nov 12, 2015 at 14:22

2 Answers 2

Reset to default
18

Let's assume that you will be using a PPTP VPN just to demonstrate the commands you need to run.
Since PPTP's encryption is broken for a long time now, I suggest you use something more secure (like OpenVPN). The principle is the same regardless of which VPN/tunnel technology you use.

So first you create the VPN without adding a default gateway route.

/interface pptp-client
add add-default-route=no allow=pap,chap,mschap1,mschap2 connect-to=VPN_SERVER_IP \
dial-on-demand=no disabled=no max-mru=1440 max-mtu=1440 mrru=dis \
name=VPN_NAME password="MY_STRONG_PASSWORD" profile=default-encryption user=USERNAME

Then you create a new routing table by adding a default gateway via the VPN with a new routing mark vpn. This will allow you to route packets via the VPN.

/ip route add dst-address=0.0.0.0/0 distance=1 gateway=VPN_GATEWAY_IP routing-mark=vpn

The next route is optional in case you want to block outgoing traffic if the VPN is down:

/ip route add dst-address=0.0.0.0/0 type=unreachable distance=2 routing-mark=vpn

We also need to do some NAT for the packets that will be leaving via the VPN interface.

/ip firewall nat add chain=srcnat out-interface=VPN_NAME action=masquerade

Now we add the mangle rule that will match the destination IPs we want and do a mark-routing on them so that they will use the vpn route table we created.

/ip firewall mangle add chain=prerouting dst-address-list=VPN action=mark-routing new-routing-mark=vpn

Finally we create an Address List on the firewall with the IPs that we want to route via the VPN.

/ip firewall address-list add list=VPN address=1.1.1.1
/ip firewall address-list add list=VPN address=2.2.2.2
/ip firewall address-list add list=VPN address=3.3.3.3
/ip firewall address-list add list=VPN address=4.4.4.4

You repeat the last rule as many times as you need for as many IPs as you want to route via the VPN.

Keep in mind that the rules above do not provide any security as to who behind your router will be able to access the VPN etc. You may need to add appropriate source IPs checks on the rules to make them more secure.

Also this method will route whole IPs via the VPN. If you need to route specific ports/protocols via the VPN you simply create additional mangle rules that match whatever you need and do mark-routing on them.

Improve this answer
8
  • 1
    Thanks man, works perfectly! When adding nat I had to specify also chain=srcnat and when adding mangle I had to specify chain=prerouting
    – pagep
    Commented Sep 21, 2016 at 17:01
  • Thanks for pointing that out. I've updated my answer. :)
    – Cha0s
    Commented Sep 21, 2016 at 20:15
  • Wondering, can address list be replaced with layer 7 addresses so I will be able to say forward requests for specific domain name through vpn
    – mac
    Commented May 21, 2017 at 5:41
  • 3
    @mac In recent versions of RouterOS you can add domains in the address list and it will automatically resolve them to addresses in the same address-list. It follows the TTL of the dns record so it will automatically keep it self up to date if an IP address changes. L7 matching is kinda PITA and very resource hungry :(
    – Cha0s
    Commented Aug 3, 2017 at 18:40
  • 1
    @Andreas I've updated my answer to accommodate for this scenario :) You simply add a second route of type "unreachable" with "distance" 2. This way, when the VPN is down, then the unreachable route becomes active and drops the outgoing traffic there instead of falling back to the main routing table.
    – Cha0s
    Commented Jan 4, 2019 at 1:38
-2

The below is a generic linux answer. I do not know if routeros has suitable functionality in it's UI and if not whether you can bypass the UI and interact with the routing/firewall/nat features in the kernel directly.

The first thing to do is to set up your VPN software and bring up the VPN interface. You should tell your VPN software NOT to make the VPN the default gateway. How exactly this is done will depend on what VPN software you are using.

You can then add specific routes to the routing table to direct traffic to certain IP addresses down the VPN.

You also need to make sure NAT is configured correctly so that the source address of packets leaving your router matches the interface they go out from. This can be done either by using the "MASQURADE" target or by setting up seperate "SNAT" rules for each interface.

Depending on the exact nature of the blocking you may find it nessacery to send some or all of your DNS traffic down the VPN. Sending all your DNS traffic down the VPN should be easy enough (just point your DNS server settings at an IP that is routed down the VPN). If (for performance or privacy reasons) you want only some of your DNS queries to go down the VPN you would need some sort of DNS proxy to split up the requests.

A further complication is if the sites you are accessing don't have stable IPs. In this case you would need a DNS proxy that could monitor replies and add routes dynamically.

Improve this answer
1
  • 1
    RouterOS does not expose any way to allow you to do anything directly to the kernel or iptables. The only way to manage MikroTik RouterOS is via a proprietary CLI (Telnet/SSH), Winbox (desktop GUI), or API.
    – Cha0s
    Commented Nov 12, 2015 at 12:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .