Chapter 3 of 4 · MikroTik MTCRE
VPN and VLANs
Tunnel types, IPIP, EoIP, PPP tunnels, VLAN tagging, QinQ, managed switches and RouterBOARD switch chips.
- 7topics
- 34 minfast track
- 1diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1What a VPN Is and the Types of VPNLearn what a VPN is, how tunnels encapsulate traffic, and how the main VPN types differ in layer, transport, encryption and…5 min
- 2Site to Site Tunnels with IPIP and EoIPLearn how to build site to site IPIP and EoIP tunnels in RouterOS, when to choose Layer 3 or Layer 2, and how to route or bridge…4 min
- 3Site to Site Tunnels with PPTP, SSTP, L2TP and PPPoELearn how PPP based tunnels work in RouterOS: server and client setup, secrets, addressing and routing for PPTP, L2TP, SSTP and…5 min
- 4VLANs and Their Usage in RouterOSLearn what a VLAN is, how 802.1Q tagging works, how to create VLAN interfaces and bridge VLAN filtering in RouterOS, and where…5 min
- 5QinQ ImplementationLearn how QinQ double tagging carries customer VLANs inside a provider VLAN, with service tags, the 802.1ad ether type and…Diagram5 min
- 6VLANs with a Managed SwitchLearn how a RouterOS router and a managed switch share VLANs over a trunk, with router on a stick routing, access ports and…5 min
- 7VLANs on the Switch Chip of a RouterBOARDLearn how RouterBOARD switch chips forward VLAN traffic in hardware, how the older switch menu relates to bridge hardware…5 min
About this chapter
What this chapter covers
VPN and VLANs is about carrying traffic for separate networks over shared links, either across the internet or across one cable.
The first half covers tunnels, which join sites over a network you do not control. The second half covers VLANs, which split one physical network into several logical ones.
The two halves belong together. A tunnel can carry a VLAN across a distance, and a VLAN can be extended with double tagging by a provider.
How the topics fit together
Both halves wrap traffic in an extra header, and the main question is what each wrapper carries and who removes it.
The topics build up in this order:
- VPN concepts explain tunnels, encapsulation and how the types differ.
- IPIP and EoIP are the simplest tunnels, one for IP and one for Ethernet.
- PPP based tunnels add a server, a client and authentication.
- VLAN usage introduces 802.1Q tags, VLAN interfaces and bridge VLAN filtering.
- QinQ stacks a second tag so a provider can carry customer VLANs.
- Managed switches show how a router and a switch share VLANs over a trunk.
- Switch chips explain how a RouterBOARD handles VLANs in hardware.
Bridge VLAN filtering needs RouterOS v6.41 or later, and some switch chip features depend on the model. The pages say where this matters.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Build the tunnels with two routers and a third acting as the internet. For VLANs, use a router and a switch, and test with a host on each VLAN. Compare the console output of the working and broken cases, because exam questions often show a configuration and ask what is wrong.
Ready for more practice?
The full MikroTik MTCRE question bank has 417 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.