Manual:Interface/EoIP < Manual:Interface Applies to RouterOS:2.9, v3, v4+ Contents [hide ] 1 Summary 2 Properties 3 Notes 4 Setup examples Summary Sub-menu: /interface eoip Standards: GRE RFC 1701 Ethernet over IP (EoIP) Tunneling is a MikroTik RouterOS protocol that creates an Ethernet tunnel between two routers on top of an IP connection. The EoIP tunnel may run over IPIP tunnel, PPTP tunnel or any other connection capable of transporting IP. When the bridging function of the router is enabled, all Ethernet traffic (all Ethernet protocols)
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Manual:Interface/EoIP< Manual:Interface
Applies to RouterOS:2.9, v3, v4+
Contents [hide]
1 Summary
2 Properties
3 Notes
4 Setup examples
Summary
Sub-menu: /interface eoip
Standards: GRE RFC 1701
Ethernet over IP (EoIP) Tunneling is a MikroTik RouterOS protocol that creates an Ethernet tunnel between two routers
on top of an IP connection. The EoIP tunnel may run over IPIP tunnel, PPTP tunnel or any other connection capable of
transporting IP.
When the bridging function of the router is enabled, all Ethernet traffic (all Ethernet protocols) will be bridged just as if
proxy-arp - the interface will use the ARP proxy feature
reply-only - the interface will only reply to requests originated
from matching IP address/MAC address combinations which are
entered as static entries in the "/ip arp" table. No dynamic
entries will be automatically stored in the "/ip arp" table.
Therefore for communications to be successful, a valid static
entry must already exist.
keepalive (integer; Default: not set) keep-alive timer, sets time interval (seconds) in what keep-alive messages should be received. If 3 messages are missed, interface running flag is removed. For this to work, keepalive has to be set to same value on both ends of the tunnel, since one end is expecting messages from the other one and is sending keepalive messages in that direction.
l2mtu (integer; Default: ) Layer2 Maximum transmission unit. Not configurable for EoIP. Read more>>
local-address (IP; Default: ) Source address of the tunnel packets, local on the router.
mac-address (MAC; Default: ) Media Access Control number of an interface. The address numeration authority IANA allows the use of MAC addresses in the range from 00:00:5E:80:00:00 - 00:00:5E:FF:FF:FF freely
mtu (integer; Default: 1500) Layer3 Maximum transmission unit
name (string; Default: ) Interface name
remote-address (IP; Default: ) IP address of remote end of EoIP tunnel
tunnel-id (integer: 65536; Default: ) Unique tunnel identifier, which must match other side of the tunnel
Notes
tunnel-id is method of identifying tunnel. It must be unique for each EoIP tunnel.
mtu should be set to 1500 to eliminate packet refragmentation inside the tunnel (that allows transparent bridging of
Ethernet-like networks, so that it would be possible to transport full-sized Ethernet frame over the tunnel).
When bridging EoIP tunnels, it is highly recommended to set unique MAC addresses for each tunnel for the bridge
algorithms to work correctly. For EoIP interfaces you can use MAC addresses that are in the range
from00:00:5E:80:00:00 - 00:00:5E:FF:FF:FF , which IANA has reserved for such cases. Alternatively, you can set the
second bit of the first byte to modify the auto-assigned address into a 'locally administered address', assigned by the
network administrator and thus use any MAC address, you just need to ensure they are unique between the hosts
connected to one bridge.
Note: EoIP tunnel adds at least 42 byte overhead (8byte GRE + 14 byte Ethernet + 20 byte IP)
Setup examples
Let us assume we want to bridge two networks: 'Office LAN' and 'Remote LAN'. By using EoIP setup can be made so that
Office and Remote LANs are in the same Layer2 broadcast domain.
Mikrotik RouterOS transparent bridge using PPtP and EoIP
In this article, I want to describe how to tunnel EoIP over a PPtP connection. EoIP is a Mikrotik specific method of bridging ethernet traffic over a routed network. The problem with using EoIP as a “VPN”, is that it is not encrypted. The network we will build in this article will tunnel the EoIP traffic over an encrypted PPtP tunnel. There are other methods available in later versions of Mikrotik RouterOS to accomplish this functionality (OpenVPN, for one example) and I will be adding articles on some of these at a later time. the method described in this article will work in any version of Mikrotik RouterOS. It has been tested under 2.8.28, 2.9.51 and 3.13.
The following picture is the network layout we are shooting for:
Our goal is the build a transparent bridge over the internet. This article gives a brief how-to describing the steps necessary to accomplish this. The PPtP tunnel is only needed in order to add encryption, since EoIP is not an encrypted tunnel.
In this configuration, there are several parts, which we will discuss individually. First, there is the IP space on both the internet side of each router and the “private” side. Note that the PRIVATE range is the SAME on both sides. This is not important for the tunnel to work, but one of the purposes of EoIP is to bridge networks in this way. It should, also, be noted that a DHCP server on either end of the tunnel will be “seen” by equipment at both ends of the tunnel.
The bridge interface on both ends includes the EoIP tunnel and the ethernet port that is plugged into the private network. This will be discussed in further detail in a few paragraphs.
To begin our config, we will first build the PPtP tunnel. We will set the left router (12.12.10.2) as the PPtP server and the right router (12.21.11.1) as the client.
The above configuration is all that is needed on the left router. It should be noted that the IP range I chose for the tunnel is NOT in the same range as the LAN segments. This is not strictly needed, but it is good network design, since these interfaces will NOT be added to the bridge.
This is the full configuration needed for the tunnel on the right router. The profile section is a default setting, but I generally specify it anyway.
The PPtP tunnel is now set up and you should see the tunnel as running on both ends. You can see the tunnel interface in Winbox under “Interfaces” and “PPP->Interfaces”. If you wish the see the IP addresses, you can see that under “IP->Addresses”.
Now we need to add the EoIP tunnel. This is the same on both ends, with the exception of the IP address we are connecting to.
It is very important that the tunnel-id parameter be the same on both ends.
Next, we will add the bridge (this is the same on both ends):
/interface bridge add name=bridge1
Hard to believe it’s that easy, but it is.
Next, we set up the bridge ports. We will assume that the LAN side of the Mikrotik routers are the ether1 interface.
/interface bridge port add bridge=bridge1 interface=ether1/interface bridge port add bridge=bridge1 interface=eoiptunnel
The name eoiptunnel is the “name” parameter we used in the configuration we did above for the tunnel setup.
That’s it for the config. It is very easy to set up this type of config. There are a couple of other notes I will make, but as far as the configuration on the Mikrotik, that’s about it.
Devices on the right router should use 192.168.1.254 as their default gateway. They will be able to see the 192.168.1.1, but if you use that as a default gateway for these devices, then ALL their traffic will go across the bridge. This may be your desire, but it is important to note this fact. (Reverse the above for devices on the left router.)
I’ve already mentioned the DHCP server. Note that IP addresses cannot be duplicated on either network. The EoIP tunnel will act just like a (very long) ethernet cable plugged into a switch at both ends of the tunnel. You are, literally, joining the 2 networks into ONE network.
I hope I haven’t missed anything. If so, I am sure someone will point this out. :-)Â I hope you find this article useful.
hello,
can’t ping the remote computers with the one’s on the other side
i am new in setting up mikrotik routerboard, and i need some help. I have made all setting according to what you have
wrote,I have tryed to bridge two networks, but i don’t know where did i go wrong, i have 2 rb750, and i can’t ping the
computers from one side to another. the config i have made on each router, in the winbox it shows that there are
conected to each other but still i can’t ping each them, i want from two computers on one side i could ping the other
computers on the other side. if i am conected through telnet on the server router i can ping the ISP public adresses
(95.77.9.206/24 and 89.39.197.248/23)the adresses i have received from my ISP’s, and can ping the tunnel private
adresses 192.168.10.1 and 192.168.10.2, but i can not ping the private adresses 192.168.1.2 attached to the
computers i work with on one side with the 192.168.1.3 from the other.
I haven’t modified anything in firewall or other rules, just setting up the internet connection and the settings above.
on one server router i have :
this router has the ip adress 95.77.9.206/24 on eth1
Ethernet over IP (EoIP) Tunneling is a MikroTik RouterOS protocol that creates an Ethernet tunnel between two routers on top of an IP connection. The EoIP tunnel may run over IPIP tunnel, PPTP tunne or any other connection capable of transporting IP.
When the bridging function of the router is enabled, all Ethernet traffic (all Ethernet protocols) will be bridged just as if there where a physical Ethernet interface and cable between the two routers (with bridging enabled). This protocol makes multiple network schemes possible.
Network setups with EoIP interfaces:
Possibility to bridge LANs over the Internet
Possibility to bridge LANs over encrypted tunnels
Possibility to bridge LANs over 802.11b 'ad-hoc' wireless networks
The EoIP protocol encapsulates Ethernet frames in GRE (IP protocol number 47) packets (just like PPTP) and sends them to the remote side of the EoIP tunnel.
mtu (integer; Default: 1500) Layer3 Maximum transmission unit
name (string; Default: ) Interface name
remote-address (IP; Default: ) IP address of remote end of EoIP tunnel
tunnel-id (integer: 65536; Default: ) Unique tunnel identifier, which must match other side of the tunnel
Notes
tunnel-id is method of identifying tunnel. It must be unique for each EoIP tunnel.
mtu should be set to 1500 to eliminate packet refragmentation inside the tunnel (that allows transparent bridging of Ethernet-like networks, so that it would be possible to transport full-sized Ethernet frame over the tunnel).
When bridging EoIP tunnels, it is highly recommended to set unique MAC addresses for each tunnel for the bridge algorithms to work correctly. For EoIP interfaces you can use MAC addresses that are in the range from00:00:5E:80:00:00 - 00:00:5E:FF:FF:FF , which IANA has reserved for such cases. Alternatively, you can set the second bit of the first byte to mark the address as locally administered address, assigned by
network administrator, and use any MAC address, you just need to ensure they are unique between the hosts connected to one bridge.
Setup examples
Let us assume we want to bridge two networks: 'Office LAN' and 'Remote LAN'. By using EoIP setup can be made so that Office and Remote LANs are in the same Layer2 broadcast domain.
As you know wireless station cannot be bridged, to overcome this limitation (not involving WDS) we will create EoIP tunnel over the wireless link and bridge it with interfaces connected to local networks.
We will not cower wireless configuration in this example, lets assume that wireless link is already established
Network setups with EoIP interfaces: • Possibility to bridge LANs over the Internet • Possibility to bridge LANs over encrypted tunnels • Possibility to bridge LANs over 802.11b 'ad-hoc' wireless networks
SpecificationsPackages required : NoneLicense required : Basic (DEMO license is limited to 4 tunnels)Home menu level : /interface eoipStandards and Technologies : GRE (RFC1701)Hardware usage: not significantRelated DocumentsSoftware Package Installation and UpgradingIP Addresses and Address Resolution Protocol (ARP)Bridge InterfacesPPTP (Point to Point Tunnel Protocol) Interface
DescriptionAn EoIP interface should be configured on two routers that have the possibility for an IP level connection. The EoIP tunnel may run over an IPIP tunnel, a PPTP 128bit encrypted tunnel, a PPPoE connection, or any connection that transports IP. Specific Properties: • Each EoIP tunnel interface can connect with one remote router which has a corresponding interface configured with the same 'Tunnel ID'. • The EoIP interface appears as an Ethernet interface under the interface list. • This interface supports all features of and Ethernet interface. IP addresses and other tunnels may be run over the interface. • The EoIP protocol encapsulates Ethernet frames in GRE (IP protocol number 47) packets (just like PPTP) and sends them to the remote side of the EoIP tunnel. • Maximal count of EoIP tunnels is 65536. EoIP SetupSubmenu leve : /interface eoip Property Descriptionname (name; default: eoip-tunnelN)- interface name for referencemtu (integer; default: 1500) - Maximum Transmission Unit. The default value provides maximal compatibilityarp (disabled | enabled | proxy-arp | reply-only; default: enabled) - Address Resolution Protocoltunnel-id (integer; default: 0) - a unique tunnel identifierremote-address - the IP address of the other side of the EoIP tunnel – must be a MikroTik routerNotestunnel-id is method of identifying tunnel. There should not be tunnels with the same tunnel-id on the same router. tunnel-id on both participient routers must be equal. mtu should be set to 1500 to eliminate packet refragmentation inside the tunnel (that allows transparent bridging of ethernet-like networks, so that it would be possible to transport full-sized ethernet frame over the tunnrl).
ExampleTo add and enable an EoIP tunnel named to_mt2 to the 10.5.8.1 router, specifying tunnel-id of 1: [admin@MikroTik] interface eoip> add name=to_mt2 remote-address=10.5.8.1 \\... tunnel-id 1[admin@MikroTik] interface eoip> printFlags: X - disabled, R - running0 X name="to_mt2" mtu=1500 arp=enabled remote-address=10.5.8.1 tunnel-id=1
[admin@MikroTik] interface eoip> enable 0[admin@MikroTik] interface eoip> printFlags: X - disabled, R - running0 R name="to_mt2" mtu=1500 arp=enabled remote-address=10.5.8.1 tunnel-id=1
[admin@MikroTik] interface eoip>EoIP Application ExampleLet us assume we want to bridge two networks: 'Office LAN' and 'Remote LAN'. The networks are connected to an IP network through the routers [Our_GW] and [Remote]. The IP network can be a private intranet or the Internet. Both routers can communicate with each other through the IP network. Our goal is to create a secure channel between the routers and bridge both networks through it. The network setup diagram is as follows:
To make a secure Ethernet bridge between two routers you should: 1. Create a PPTP tunnel between them. Our_GW will be the pptp server: 2. [admin@Our_GW] interface pptp-server> /ppp secret add name=joe service=pptp \3. \... password=top_s3 local-address=10.0.0.1 remote-address=10.0.0.24. [admin@Our_GW] interface pptp-server> add name=from_remote user=joe5. [admin@Our_GW] interface pptp-server> server set enable=yes
6. [admin@Our_GW] interface pptp-server> print7. Flags: X - disabled, D - dynamic, R - running8. # NAME USER MTU CLIENT-ADDRESS UPTIME ENC...9. 0 from_remote joe10. [admin@Our_GW] interface pptp-server>The Remote router will be the pptp client: [admin@Remote] interface pptp-client> add name=pptp user=joe \\... connect-to=192.168.1.1 password=top_s3 mtu=1500 mru=1500[admin@Remote] interface pptp-client> enable pptp[admin@Remote] interface pptp-client> printFlags: X - disabled, R - running0 R name="pptp" mtu=1500 mru=1500 connect-to=192.168.1.1 user="joe"password="top_s2" profile=default add-default-route=no
[admin@Remote] interface pptp-client>See the PPTP Interface Manual for more details on setting up encrypted channels. 11. Configure the EoIP tunnel by adding the eoip tunnel interfaces at both routers. Use the ip addresses of the pptp tunnel interfaces when specifying the argument values for the EoIP tunnel: 12. [admin@Our_GW] interface eoip> add name="eoip-remote" tunnel-id=0 \13. \... remote-address=10.0.0.214. [admin@Our_GW] interface eoip> enable eoip-remote15. [admin@Our_GW] interface eoip> print
16. Flags: X - disabled, R - running17. 0 name=eoip-remote mtu=1500 arp=enabled remote-address=10.0.0.2 tunnel-id=018. [admin@Our_GW] interface eoip>19. 20. [admin@Remote] interface eoip> add name="eoip" tunnel-id=0 \21. \... remote-address=10.0.0.122. [admin@Remote] interface eoip> enable eoip-main23. [admin@Remote] interface eoip> print24. Flags: X - disabled, R - running25. 0 name=eoip mtu=1500 arp=enabled remote-address=10.0.0.1 tunnel-id=026. 27. [Remote] interface eoip>28. Enable bridging between the EoIP and Ethernet interfaces on both routers. On the Our_GW: [admin@Our_GW] interface bridge> add forward-protocols=ip,arp,other \\... disabled=no[admin@Our_GW] interface bridge> printFlags: X - disabled, R - running0 R name="bridge1" mtu=1500 arp=enabled mac-address=00:00:00:00:00:00forward-protocols=ip,arp,other priority=1
[admin@Our_GW] interface bridge> port printFlags: X - disabled# INTERFACE BRIDGE0 eoip-remote none1 office-eth none2 isp none
[admin@Our_GW] interface bridge> port set "0,1" bridge=bridge1And the same for the Remote: [admin@Remote] interface bridge> add forward-protocols=ip,arp,other \\... disabled=no[admin@Remote] interface bridge> printFlags: X - disabled, R - running0 R name="bridge1" mtu=1500 arp=enabled mac-address=00:00:00:00:00:00forward-protocols=ip,arp,other priority=1
[admin@Remote] interface bridge> port printFlags: X - disabled# INTERFACE BRIDGE0 ether none1 adsl none2 eoip-main none