Bridging · Topic 1 of 4

L2TP and EoIP Bridging

Join two remote LANs at Layer 2 with an EoIP tunnel over L2TP: tunnel id, endpoint addresses, bridge ports, IPsec protection and how to verify it.

  • 4 min
In a nutshell
  • EoIP carries Ethernet frames, so it joins two LANs at Layer 2.
  • EoIP uses IP protocol 47.
  • Both ends must use the same tunnel-id.

What it is

EoIP is a MikroTik tunnel that carries Ethernet frames across an IP network, so two remote LANs act like one.

It is a Layer 2 tunnel. Hosts at both sites sit in the same broadcast domain, and they can use the same subnet and the same DHCP server.

L2TP supplies the IP path between the routers, and EoIP runs inside it. Bridges at each end join the tunnel to the local LAN.

LAN Abridge on router AEoIP over L2TPRouter Bbridge on router Bsame broadcast domainLAN Bone subnet

How it works

You build the L2TP tunnel first, then run EoIP between the two tunnel addresses, then bridge it.

Step 1: the L2TP tunnel

Set up an L2TP server and client as in the earlier chapter, and give each end a fixed address. A fixed remote-address in the secret keeps the client tunnel address stable.

The EoIP tunnel needs stable endpoints, so fixed tunnel addresses matter. If an address changed after a reconnect, EoIP would lose its peer.

Step 2: the EoIP interface

EoIP uses IP protocol 47, the same protocol number as GRE. Each router names the other end, and both use the same tunnel ID.

# Router A, tunnel addresses 10.98.0.1 and 10.98.0.2
/interface eoip add name=eoip-to-b remote-address=10.98.0.2 tunnel-id=10

# Router B
/interface eoip add name=eoip-to-a remote-address=10.98.0.1 tunnel-id=10
SettingWhat it does
remote-addressThe tunnel address of the far router.
local-addressOptional source address for the tunnel.
tunnel-idNumber that must be the same on both ends.
mac-addressAddress of the EoIP interface.
mtuSize limit for frames on the tunnel.

Step 3: the bridges

Put the EoIP interface and the LAN port in one bridge on each router.

/interface bridge add name=bridge-lan
/interface bridge port add bridge=bridge-lan interface=ether2
/interface bridge port add bridge=bridge-lan interface=eoip-to-b

Frames from the LAN go out through the tunnel, and frames from the tunnel reach the LAN. Do not give an IP address to a bridge port. Put any address on the bridge itself.

Why use L2TP underneath

EoIP does not encrypt. L2TP with IPsec gives the path protection, so the Ethernet frames travel inside an encrypted tunnel.

L2TP also gives the tunnel stable addresses, and it can cross NAT. The cost is extra header size, so the usable MTU is smaller.

Size of frames

Each wrapper adds bytes. A full sized Ethernet frame may no longer fit in one packet of the underlying path.

Test with large pings across the bridge. If large frames fail, lower the mtu of the EoIP interface or fix the MTU of the path.

Loops

A bridge between two sites can form a loop if a second path exists. Enable a spanning tree protocol on the bridge when there are two paths, or keep a single path.

/interface bridge set bridge-lan protocol-mode=rstp

Verification

/interface eoip print
/interface bridge port print
/interface bridge host print

A working EoIP interface shows the flag R. /interface bridge host print shows MAC addresses learned from the far site once traffic flows. A ping from a host at one site to a host at the other should work.

Version note

EoIP and bridging work in RouterOS v6 and v7. Bridge settings such as protocol-mode are the same in both versions.

What to remember for the exam

Seven facts cover most EoIP questions.

  • EoIP carries Ethernet frames, so it joins two LANs at Layer 2.
  • EoIP uses IP protocol 47.
  • Both ends must use the same tunnel-id.
  • Each end names the other with remote-address.
  • The EoIP interface and a LAN port are placed in one bridge.
  • EoIP is not encrypted, so L2TP with IPsec can carry it.
  • Fixed tunnel addresses keep the EoIP endpoints stable.
Exam tip

If the tunnel is running but pings fail, check that the EoIP interface is a port of the bridge on both routers.

Common mistakes

These four errors appear again and again.

Different tunnel IDs. The two ends never match, so the tunnel does not pass traffic.

Forgetting to bridge. An EoIP interface that is not a bridge port joins nothing.

A changing tunnel address. If the L2TP address moves, the EoIP peer is lost.

Ignoring the MTU. Small packets work and large ones fail, which looks like a random fault.

Watch out

Two sites bridged over two paths without spanning tree create a loop that can bring both LANs down.

Check yourself

Work through these three questions.

  • What does EoIP carry, and at which layer does it join the sites?

    It carries Ethernet frames, so it joins the sites at Layer 2.

  • Which settings must match for an EoIP tunnel to pass traffic?

    Both ends need the same tunnel-id, and each end must name the other with remote-address.

  • Why run EoIP over L2TP with IPsec?

    EoIP does not encrypt. L2TP with IPsec protects the frames and gives stable tunnel addresses.

Topic 1 of 4 in Bridging

Test yourself on Bridging

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.