I downloaded nordvpn-bin from AUR and I suspect this version is doing something that is messing with the ability to use a machine as a gateway, as I do with all my other VPN services. For some reason just Nord in particular isn't working as expected.
- Internet forwarding seems to be working fine - client phone for testing using 192.168.0.200 as a gateway working for all traffic
- # systemctl start nordvpn
- use nordvpn CLI to login and then connect
- Connectivity on the server itself is all good, opening IP check page shows the VPN IP and everything is all as intended
However, now is where I am stuck, because when I go back to my phone and open web pages to test with - the traffic is still coming through as my unsecured public IP address and NOT the NordVPN address. Why?
And crossed my fingers thinking this would be the hurrah! moment - but sadly - no. The Arch is still curling the correct NordVPN IP when I do it directly from that machine, but outside clients are not going through the VPN and public IP is displayed.
I'm a newbie user and not 100% sure what this means so my apologies if this isn't what you asked. IPv6 Configuration is strictly set to DISABLED in NetworkManager altogether on both 'nordlynx' and 'Wired Ethernet 1 (ens18)'
And then lastly you asked how did I configure the phone to use a different gateway, I just always pick manual setup instead of DHCP and then assign myself an IP address, my Pi-Hole as DNS server, and 192.168.0.200 (or any other of my several Arch gateway IPs) as the gateway and it works amazingly for ALL other vpn's like my ProtonVPN and WindScribe. I can play Xbox Live and PSN network through them even without any kind of bad lag etc. super fast speeds
- Every packet created (not forwarded) on the Arch box has no firewall mark (fwmark)
- The ip rule sends those packets as a special default route to the nordlynx interface
- Packets emerging from the nordlynx interface get the fwmark set by the VPN interface
- The packets with the fwmark (VPN tunnel packets headed for the NordVPN endpoint) are routed via the normal default route
I disabled the Firewall option and disabled the Routing option and I made an error above when describing what happens when I do this : the tunnel goes up but no traffic is routed through it, that's all. I mistakenly said there's no connectivity above which is wrong - there's connectivity and the tunnel logs in and stays up, with nordlynx device etc, but since no routing rules are issued, no traffic goes through it.
Since it is now fully disabled in the app itself, would it be possible to issue the commands manually? I know for example when a WireGuard tunnel goes up for example it usually self-issues a series of ip commands, is this the route that it's setting up, and how would I set it manually if so?
Yikes, yeah I wouldn't know where to begin here in trying to do this myself. This issue is still unresolved and I think it has something to do with however nordvpn is configuring itself, as I have multiple identical VM's here acting as gateways for other major providers and none have this issue - it's exclusive to the nord gateway sadly
Compare the routing tables (as above) with one of your other VPN gateways. If my theory is correct those clients use a from of routing I know from OpenVPN (double default route with different metrics and a host route for the VPN endpoint).
If you can determine the "inner" IPv4 address of your NordVPN endpoint (e.g. via traceroute while connected to the VPN) you may be able to create a much simpler routing solution - which in turn should work with forwarding.
So it's absolutely something that the software is doing. They changed something along the way and I forget where I read about it but there was just a one-off random comment in all of the research I was doing on reddit from a guy claiming he couldn't get some feature to work on the newest nordvpn release and had to downgrade. The second I dropped back to 3.15.0 it works absolutely perfectly, using it as we speak with zero problems, and zero frustration.
Strange stuff indeed. I think disabling routing in the newest version and issuing the proper set of commands would be great, just not sure how to begin really.. I wish there was a way to reach someone that mattered at nordvpn about this. I see their tool is on github.
Thank you for sticking with me through all of this even if we didn't get it resolved. As far as I'm concerned I'll just use 3.15.0 forever until I absolutely need some kind of feature in the later versions (or they fix it!)
Unfortunately, if you're like me, you didn't read either of those guides and purchased 2 years worth of NordVPN and realized that NordVPN does not provide an easy configuration file to setup your WG tunnel. After much experimenting and failure, I believe I have found the solution to manually create the wireguard tunnel.
First off, you want to follow this guide for getting your nordvpn private/public keys manually. Note: you will need a Linux OS (an unraid VM works too. I personally spun up a quick ubuntu instance to do just this).
5. If the tunnel works you should see the handshake like above. Also, you can sanity test by downloading the firefox docker and assigning the network type to "Custom: wg2" (or whatever wg tunnel instance). Then you can navigate to what's my IP or other website to verify the VPN address.
Thank you for this! I spent a few days setting up the Nordlynx container and have it working beautifully for a few Dockers now. I would like to get this rolling instead for a bit more built-innedness, in addition to facilitating remote access to my server (to include the Dockers).
My firewall is blocking all the sessions from nordvpn but it still consumes the data. The attached screenshot is of 24hr activity even my servers are shutdown but it is making sessions with my complete IP Pool.
Could you please share the output for the below-mentioned commands?
config firewall policy
edit
sh full
end
To check the policy ID Kindly check the related policy on device GUI(Policy and objects >> Firewall policy/IPv4 policy)
May I know whether do you created any rule or web filter or application control to block it?
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
64591212e2