VPN and VLANs · Topic 2 of 7

Site to Site Tunnels with IPIP and EoIP

Learn how to build site to site IPIP and EoIP tunnels in RouterOS, when to choose Layer 3 or Layer 2, and how to route or bridge across them.

4 min

In a nutshell

IPIP is a Layer 3 tunnel that wraps IP in IP, using IP protocol 4.
EoIP is a Layer 2 tunnel that carries Ethernet frames over GRE.
EoIP needs the same tunnel-id at both ends.

What it is

IPIP and EoIP are simple site to site tunnels that need only the public addresses of the two routers.

IPIP wraps one IP packet inside another IP packet. EoIP wraps a whole Ethernet frame, so it can join two sites into one Layer 2 network.

Neither one encrypts the traffic. They are quick to set up and are often placed on top of IPsec when security is needed.

How it works

You create the tunnel interface on each router, address it, and then route or bridge across it.

IPIP

An IPIP interface needs the local and remote public addresses. Each router uses the other's address as its remote address.

/interface ipip add name=ipip-to-r2 local-address=203.0.113.1 remote-address=198.51.100.1
/ip address add address=10.255.0.1/30 interface=ipip-to-r2
/ip route add dst-address=192.168.2.0/24 gateway=10.255.0.2

R2 mirrors this with the addresses swapped and its own tunnel address, 10.255.0.2/30. The tunnel addresses form a small network between the routers. The route then sends the remote LAN through the tunnel.

IPIP carries IP packets only. Layer 2 traffic such as broadcasts from a LAN does not cross it.

EoIP

EoIP is a MikroTik protocol. It uses GRE as transport, which is IP protocol 47. It also has a tunnel-id that must be the same at both ends.

/interface eoip add name=eoip-to-r2 remote-address=198.51.100.1 tunnel-id=10

R2 uses the same tunnel-id and the other router's address. Several EoIP tunnels between the same two routers need different tunnel ids.

Because EoIP carries Ethernet frames, you can add it to a bridge together with the LAN port. Hosts at both sites then sit in one broadcast domain.

/interface bridge port add bridge=bridge-lan interface=eoip-to-r2

Comparing IPIP and EoIP

Feature	IPIP	EoIP
Carries	IP packets	Ethernet frames
Transport	IP protocol 4	GRE, IP protocol 47
Needs a tunnel id	No	Yes
Use with bridge	No	Yes
Encryption	None	None
Typical use	Routed site links	Joining Layer 2 across sites

Size and fragmentation

Each tunnel adds an outer header, so the usable inner packet is smaller than on a normal link. Large packets can then fail to cross the tunnel, even when small pings work.

Check the tunnel interface size and compare it with the path. Lowering the size, or clamping the TCP segment size for traffic that crosses the tunnel, avoids the problem.

Keeping the tunnel up

A tunnel interface can use keepalives, depending on type and version. If the far end stops answering, the interface is marked not running, and routes that use it are withdrawn.

This matters for backup design. A route through a tunnel with keepalives enabled disappears when the path fails, so a floating route can take over.

Verifying

/interface ipip print
/interface eoip print
/ping 10.255.0.2

The R flag shows that the interface is running. A tunnel that does not come up usually has a wrong remote address, a wrong tunnel id or a firewall that blocks the transport.

Exam tip

Allow IP protocol 4 for IPIP and IP protocol 47 for EoIP in the firewall of both routers.

What to remember for the exam

Seven facts cover most questions on this topic.

IPIP is a Layer 3 tunnel that wraps IP in IP, using IP protocol 4.
EoIP is a Layer 2 tunnel that carries Ethernet frames over GRE.
EoIP needs the same tunnel-id at both ends.
IPIP needs an address and a route, and EoIP can go into a bridge.
Neither tunnel encrypts traffic.
Encapsulation lowers the usable packet size.
Firewalls must allow the tunnel protocol between the public addresses.

Watch out

Bridging a LAN through EoIP also carries broadcasts and loops. Never create a second path between the same two bridges.

Common mistakes

These four errors appear often.

Different tunnel ids on the two EoIP ends. The tunnel never comes up, even though the addresses are correct.

Forgetting the route. An IPIP tunnel with addresses but no route to the remote LAN passes no site traffic.

Blocking the protocol. IPIP and GRE are not TCP or UDP, so a firewall that only allows ports will drop them.

Assuming a tunnel is private. Without IPsec the traffic travels in clear text.

Check yourself

Work through these three questions.

What is the difference between IPIP and EoIP?
IPIP carries IP packets and is routed, while EoIP carries Ethernet frames and can be bridged. EoIP also needs a tunnel-id.
What must match on both ends of an EoIP tunnel?
The tunnel-id must match, and each router must use the other's address as its remote-address.
Which protocols must a firewall allow for these tunnels?
IPIP uses IP protocol 4, and EoIP uses GRE, which is IP protocol 47. Neither is TCP or UDP.

Topic 2 of 7 in VPN and VLANs

Test yourself on VPN and VLANs

The full MikroTik MTCRE question bank has 417 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.