🛡 MikroTik bilan NordVPN IKEv2 EAP tunnelini sozlash

❗ Muammo

NordVPN serverlariga IKEv2/EAP orqali xavfsiz tunnel yaratish kerak, lekin RouterOSda bu funksiyani qanday yoqish aniq ko‘rsatilmagan.

🎯 Yechim

RouterOS v6.45+ yoki v7.x versiyalarida IKEv2‑ni EAP‑MSCHAPv2 autentifikatsiyasi bilan sozlab, NordVPN serverlariga dinamik IPsec tunnelini yaratish.

🛠 Sozlash bosqichlari

1️⃣ Root CA ni yuklab olib import qilish

NordVPN ning asosiy sertifikati RouterOSga import qilinadi.

/tool fetch url="https://downloads.nordvpn.com/certificates/root.der"
/certificate import file-name=root.der

2️⃣ Sertifikatni tasdiqlash

Import qilingan sertifikat ro‘yxatini tekshiring.

/certificate print where name~"root.der"

3️⃣ IPsec profil va proposal yaratish

NordVPN uchun alohida profile va proposal yaratish tavsiya etiladi.

/ip ipsec profile
add name=NordVPN
/ip ipsec proposal
add name=NordVPN pfs-group=none

4️⃣ Policy group va default policy qo‘shish

Policy‑larni boshqa konfiguratsiyalardan ajratish uchun group yaratamiz.

/ip ipsec policy group
add name=NordVPN
/ip ipsec policy
add dst-address=0.0.0.0/0 group=NordVPN proposal=NordVPN src-address=0.0.0.0/0 template=yes

5️⃣ Mode‑config sozlamasi

Serverdan konfiguratsiya parametrlarini olish uchun responder=no bilan mode‑config yarating.

/ip ipsec mode-config
add name=NordVPN responder=no

6️⃣ Peer va identity yaratish

NordVPN serveri (masalan, lv20.nordvpn.com) va EAP‑MSCHAPv2 login ma’lumotlarini kiriting.

/ip ipsec peer
add address=lv20.nordvpn.com exchange-mode=ike2 name=NordVPN profile=NordVPN
/ip ipsec identity
add auth-method=eap certificate="" eap-methods=eap-mschapv2 generate-policy=port-strict mode-config=NordVPN peer=NordVPN policy-template-group=NordVPN username=support@mikrotik.com password=secret

7️⃣ Tunnel holatini tekshirish

Peer va SA (Security Association) faoliyatini ko‘rib chiqing.

/ip ipsec
active-peers print
installed-sa print

8️⃣ Mahalliy tarmoqni belgilash (barcha trafik uchun)

Local tarmoqni address‑listga qo‘shing.

/ip firewall address-list
add address=10.5.8.0/24 list=local

9️⃣ Mode‑config ga address‑listni ulash

Dinamik NAT qoidalari avtomatik yaratiladi.

/ip ipsec mode-config
set [ find name=NordVPN ] src-address-list=local

🔟 Dinamik NAT qoidasini tekshirish

Tunnel o‘rnatilganda src-nat qoidasi dinamik yaratiladi.

/ip firewall nat print

1️⃣1️⃣ Maxsus trafikni tanlash (connection‑mark usuli)

Faqat tanlangan manzillar (masalan, mikrotik.com va 8.8.8.8) tunnel orqali o‘tkaziladi.

/ip ipsec mode-config
set [ find name=NordVPN ] connection-mark=NordVPN

/ip firewall address-list
add address=mikrotik.com list=VPN
add address=8.8.8.8 list=VPN

/ip firewall mangle
add action=mark-connection chain=prerouting dst-address-list=VPN new-connection-mark=NordVPN passthrough=yes

⚠️ Diqqat

IKEv2/EAP qo‘llab‑quvvatlanishi RouterOS v6.45+ va v7.x da mavjud. v7 da policy-template-group o‘rniga policy-template ishlatiladi.
Mode‑config dinamik manzilini local address‑listdan ajratish lozim, aks holda NAT qoidasi noto‘g‘ri ishlashi mumkin.

✅ Xulosa

RouterOSda bir necha oddiy buyruqlar yordamida NordVPN IKEv2‑EAP tunnelini yaratib, barcha yoki tanlangan trafikni xavfsiz yo‘nalishda uzatish mumkin.