If you cannot get rid of the other traffic, the best criterion for exclusion from fasttracking seems to be the address-list used by the dynamically added src-nat rule - i.e. So if you can stop all non-VPN traffic for a while, you can simply disable the fasttracking rule and try whether new connections through VPN will get faster. So your rule set will not prevent those packets from making their connection fasttracked.īut as said earlier, it seemed to me that fasttracking stopped interfering with IPsec in the recent RouterOS releases, so maybe there is another reason for your lower-than-expected speed. And when the packet passes through the mangle and/or the filter, the src-nat operation is not yet executed, so it doesn't yet match the policy which it will match once the src-nat will happen. The matcher doesn't anticipate future, it merely checks whether the packet's headers as they look like at the very moment when the packet is handled by the rule match to the traffic selector of any policy with action=encrypt. There is a specific problem associated to use of ipsec-policy matcher in /ip firewall filter or /ip firewall mangle rules when src-nat needs to be used to make the packets actually match the ipsec policy.

Nord vpn download speed is slow