MikroTik EOIP Behind a NAT

MikroTik EOIP Behind a NAT

The following is a description on how to setup an EOIP tunnel with Untagged and Tagged VLANs when one of the endpoints is behind a NAT. This guide assumes you have both a device that is accessible without a NAT as well as the appropriate firewall rules in place.

R1 Configuration WAN Facing Router

  1. Create the PPP Profile for Devices.
    • /ppp profile add change-tcp-mss=yes local-address=192.168.60.1 name=VPN use-encryption=yes
  2. Enable and configure the L2TP server. Make sure you change the IPSEC Secret.
    • /interface l2tp-server server set enabled=yes ipsec-secret=IPSECPASSWORD use-ipsec=required
  3. Create the VPN User for EOIP Access.
    • /ppp secret add local-address=192.168.60.1 name=TEST_VPN_USER profile=VPN remote-address=192.168.60.2 service=l2tp
  4. Build the Bridges for Tagged and Untagged Traffic
    • /interface bridge
    • add name=EOIP_TAGGED_BRIDGE_60
    • add name=EOIP_UNTAGGED_BRIDGE
  5. Build the EOIP Interface
    • /interface eoip add local-address=192.168.60.1 name=eoip-tunnel1 \ remote-address=192.168.60.2 tunnel-id=60
  6. Build the Tagged VLAN on the EOIP Interface
    • /interface vlan add interface=eoip-tunnel1 name=vlan60-eoip1 vlan-id=60
  7. Add the Interfaces to the Bridge for Tagged VLAN
    • /interface bridge port add bridge=EOIP_TAGGED_BRIDGE_60 interface=vlan60-eoip1
  8. Add the Interfaces to the Bridge for Untagged Traffic
    • /interface bridge port add bridge=EOIP_UNTAGGED_BRIDGE interface=eoip-tunnel1

R2 Configuration

  1. Create the L2TP/IPSEC Client
    • /interface l2tp-client add connect-to=WAN_IP_OF_R1 disabled=no name=l2tp-out1 use-ipsec=yes user=\ TEST_VPN_USER
  2. Build the Bridges for Tagged and Untagged Traffic
    • /interface bridge
    • add name=EOIP_TAGGED_BRIDGE_60
    • add name=EOIP_UNTAGGED_BRIDGE
  3. Build the EOIP Interface
    • /interface eoip add local-address=192.168.60.2 name=eoip-tunnel1 \ remote-address=192.168.60.1 tunnel-id=60
  4. Build the Tagged VLAN on the EOIP Interface
    • /interface vlan add interface=eoip-tunnel1 name=vlan60-eoip1 vlan-id=60
  5. Add the Interfaces to the Bridge for Tagged VLAN
    • /interface bridge port add bridge=EOIP_TAGGED_BRIDGE_60 interface=vlan60-eoip1
  6. Add the Interfaces to the Bridge for Untagged Traffic
    • /interface bridge port add bridge=EOIP_UNTAGGED_BRIDGE interface=eoip-tunnel1

Leave a Reply

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.