MikroTik kill switch and leak check

What you get

Traffic you have chosen to send through the tunnel stops, rather than leaving over your normal connection, whenever the ForestVPN container cannot be reached. You also get a test that shows it.

Before you start

• Device: a MikroTik that already routes some of your LAN through the container, with the via-fvpn routing table from choosing what goes through the tunnel, step 1 and one of its recipes.
• Firmware: RouterOS 7 (tested on 7.24.1). The syntax differs from RouterOS 6.
• Where: paste on the box that routes your LAN. That may not be the box running the container.
• Time: ten minutes, plus the test.
• What can break: a wrong rule order. The drop rule must sit above the fasttrack exemption from step 1, or it is never reached.

Steps

1. Make the route to the container count only while the container answers.

   Adds a health check to the route

   /ip/route/set [find routing-table=via-fvpn dst-address=0.0.0.0/0] \
       check-gateway=ping

2. Add a fallback route that drops. It stays inactive while the real route is up.

   Adds the drop route

   /ip/route/add dst-address=0.0.0.0/0 blackhole distance=10 \
       routing-table=via-fvpn comment="fvpn: kill switch - no exit, no traffic"

3. Close the leak the first two cannot see: a container that answers ping while its own tunnel is down forwards to its default gateway, which is you. Substitute your router's address on the container's /30 if you changed it.

   Drops container traffic that would leave over the internet

   /ip/firewall/filter/add chain=forward action=drop src-address=172.31.254.1 \
       out-interface-list=WAN \
       place-before=[find comment="fvpn: marked flows skip fasttrack"] \
       comment="fvpn: kill switch - overlay source must not leave over WAN"

4. Optional: make one device tunnel-only, whatever the routing tables say.

   Drops a named device's traffic that is not tunnelled

   /ip/firewall/address-list/add list=fvpn-only address=192.168.88.50 \
       comment="fvpn: the work laptop"
   /ip/firewall/filter/add chain=forward action=drop src-address-list=fvpn-only \
       out-interface-list=WAN \
       place-before=[find comment="fvpn: marked flows skip fasttrack"] \
       comment="fvpn: kill switch - these devices are tunnel-only"

5. Check IPv6. Everything above is IPv4. If your router has working IPv6, traffic you selected also reaches its destination over IPv6, around the tunnel.

   Shows whether the router advertises IPv6 and has a default route

   /ipv6/nd/print where ra-lifetime!=none
   /ipv6/route/print where dst-address="::/0" and routing-table="main"

Check it worked

First confirm the order of the rules and that counters move.

Shows rule order and the route table

/ip/firewall/filter/print
/ip/route/print where routing-table=via-fvpn

Then run the leak test, when nobody needs the internet. From a device on your LAN, open a "what is my IP" page: it should show the exit's address. Stop the container, wait half a minute and reload the page.

Stops the container

/container/stop [find name="fvpn"]

The page must fail to load. If it shows your own address, traffic is leaking: re-check step 3 and the rule order. Start the container again afterwards.

Starts the container

/container/start [find name="fvpn"]

Undo it

Removes only the kill switch

/ip/firewall/filter/remove [find comment~"^fvpn: kill switch"]
/ip/route/remove [find comment="fvpn: kill switch - no exit, no traffic"]
/ip/route/set [find routing-table=via-fvpn dst-address=0.0.0.0/0] !check-gateway

If something is wrong

Limits

• It covers the traffic you selected, not the rest of your network.
• IPv4 only; the IPv6 check in step 5 is yours to act on.
• A kill switch on a router stops traffic. It does not tell you why the container is down; see troubleshooting.