Mikrotik RouterOS transparent bridge using PPtP and EoIP
In this article, I want to describe how to tunnel EoIP over a PPtP connection. EoIP is a Mikrotik specific method of bridging ethernet traffic over a routed network. The problem with using EoIP as a “VPN”, is that it is not encrypted. The network we will build in this article will tunnel the EoIP traffic over an encrypted PPtP tunnel. There are other methods available in later versions of Mikrotik RouterOS to accomplish this functionality (OpenVPN, for one example) and I will be adding articles on some of these at a later time. the method described in this article will work in any version of Mikrotik RouterOS. It has been tested under 2.8.28, 2.9.51 and 3.13.
The following picture is the network layout we are shooting for:
Our goal is the build a transparent bridge over the internet. This article gives a brief how-to describing the steps necessary to accomplish this. The PPtP tunnel is only needed in order to add encryption, since EoIP is not an encrypted tunnel.
In this configuration, there are several parts, which we will discuss individually. First, there is the IP space on both the internet side of each router and the “private” side. Note that the PRIVATE range is the SAME on both sides. This is not important for the tunnel to work, but one of the purposes of EoIP is to bridge networks in this way. It should, also, be noted that a DHCP server on either end of the tunnel will be “seen” by equipment at both ends of the tunnel.
The bridge interface on both ends includes the EoIP tunnel and the ethernet port that is plugged into the private network. This will be discussed in further detail in a few paragraphs.
To begin our config, we will first build the PPtP tunnel. We will set the left router (12.12.10.2) as the PPtP server and the right router (12.21.11.1) as the client.
Left router:
/interface pptp-server server set enabled=yes
/ppp secret
add name="USERNAME" service=pptp password="PASS" \
local-address=192.168.10.1 remote-address=192.168.10.2 \
disabled=no The above configuration is all that is needed on the left router. It should be noted that the IP range I chose for the tunnel is NOT in the same range as the LAN segments. This is not strictly needed, but it is good network design, since these interfaces will NOT be added to the bridge.
Right Router:
/interface pptp-client
add name="pptp-tunnel1" connect-to=12.12.10.2 \
user="USERNAME" password="PASS" \
profile=default-encryption add-default-route=no \
disabled=no This is the full configuration needed for the tunnel on the right router. The profile section is a default setting, but I generally specify it anyway.
The PPtP tunnel is now set up and you should see the tunnel as running on both ends. You can see the tunnel interface in Winbox under “Interfaces” and “PPP->Interfaces”. If you wish the see the IP addresses, you can see that under “IP->Addresses”.
Now we need to add the EoIP tunnel. This is the same on both ends, with the exception of the IP address we are connecting to.
LEFT:
/interface eoip add name=eoiptunnel remote-address=192.168.10.2 \
tunnel-id=101 disabled=no
RIGHT:
/interface eoip add name=eoiptunnel remote-address=192.168.10.1 \
tunnel-id=101 disabled=no
It is very important that the tunnel-id parameter be the same on both ends.
Next, we will add the bridge (this is the same on both ends):
/interface bridge add name=bridge1
Hard to believe it’s that easy, but it is.
Next, we set up the bridge ports. We will assume that the LAN side of the Mikrotik routers are the ether1 interface.
/interface bridge port add bridge=bridge1 interface=ether1
/interface bridge port add bridge=bridge1 interface=eoiptunnel
The name eoiptunnel is the “name” parameter we used in the configuration we did above for the tunnel setup.
That’s it for the config. It is very easy to set up this type of config. There are a couple of other notes I will make, but as far as the configuration on the Mikrotik, that’s about it.
Devices on the right router should use 192.168.1.254 as their default gateway. They will be able to see the 192.168.1.1, but if you use that as a default gateway for these devices, then ALL their traffic will go across the bridge. This may be your desire, but it is important to note this fact. (Reverse the above for devices on the left router.)
I’ve already mentioned the DHCP server. Note that IP addresses cannot be duplicated on either network. The EoIP tunnel will act just like a (very long) ethernet cable plugged into a switch at both ends of the tunnel. You are, literally, joining the 2 networks into ONE network.
I hope I haven’t missed anything. If so, I am sure someone will point this out. :-)Â I hope you find this article useful.
June 30th, 2009 at 1:21 am
Hello
I bought a VPN access and I have been able to connect it to a windows OS and successfully shared it on my local network (about 4 computers) and it worked fine i was hoping I would be able to do the same on the mikrotik, I has been able to connect the mikrotik to the VPN network but I dont know how to share over the net work
Please could you reply
thanks
June 30th, 2009 at 11:51 am
This depends a little on how your access works. I’m assuming that it works via a PPtP connection. If that is the case, then I suspect that the reason it is not working is either related to your NAT rule or default route. This isn’t really the place to troubleshoot these things, but you can find my contact information at my consulting website at http://www.butchevans.com/
September 17th, 2010 at 12:31 pm
[…] redes fÃsicas independentes apenas para um IP! GA_googleFillSlot("300×250-forum-fistpost"); Mikrotik RouterOS transparent bridge using PPtP and EoIP | Butch Evans Blog Celso Domingues Consultoria técnica em TI Tel.: +55 71 9957-3698 سو٠يوÙر اليسوع […]
September 20th, 2010 at 11:20 am
Great illustration. It works flawlessly.
I need to implement EoIP over PPtP to connect 70 stores to corporate offices. Do I need to create 70 different tunnels or can I point all the routers at the remote sites to the same EoIP tunnel @ corporate office?
September 21st, 2010 at 1:11 am
Are you wanting to have all 70 stores on the same subnet? If not, then you only need the 70 pptp tunnels. If you DO need them all on the same subnet, then you would need to have one pptp/eoip tunnel per store.
December 14th, 2010 at 12:04 am
[…] via radius. com a rede roteada e autenticação direto no servidor teria de fazer isso: Mikrotik RouterOS transparent bridge using PPtP and EoIP | Butch Evans Blog qualquer coisa estamos ai… clica na estrelinha pra agradecer. Citar + […]
December 24th, 2010 at 12:15 pm
hello,
can’t ping the remote computers with the one’s on the other side
i am new in setting up mikrotik routerboard, and i need some help. I have made all setting according to what you have wrote,I have tryed to bridge two networks, but i don’t know where did i go wrong, i have 2 rb750, and i can’t ping the computers from one side to another. the config i have made on each router, in the winbox it shows that there are conected to each other but still i can’t ping each them, i want from two computers on one side i could ping the other computers on the other side. if i am conected through telnet on the server router i can ping the ISP public adresses (95.77.9.206/24 and 89.39.197.248/23)the adresses i have received from my ISP’s, and can ping the tunnel private adresses 192.168.10.1 and 192.168.10.2, but i can not ping the private adresses 192.168.1.2 attached to the computers i work with on one side with the 192.168.1.3 from the other.
I haven’t modified anything in firewall or other rules, just setting up the internet connection and the settings above.
on one server router i have :
this router has the ip adress 95.77.9.206/24 on eth1
ip adress 192.168.1.1/24 on eth2
/interface pptp-server server set enabled=yes
/ppp secret
add name=”USERNAME” service=pptp password=”PASS” local-address=192.168.10.1 remote-address=192.168.10.2 disabled=no
/interface eoip add name=eoiptunnel remote-address=192.168.10.2 tunnel-id=101 disabled=no
/interface bridge add name=bridge1
/interface bridge port add bridge=bridge1 interface=ether1
/interface bridge port add bridge=bridge1 interface=eoiptunnel
on routes it has
AS 0.0.0.0/0 95.77.9.1 reachable bridge1 distance 1
DS 0.0.0.0/0 89.137.205.193 reachable bridge1 distance 1
DAC 95.77.9.0/24 bridge1 reachable distance 0 pref source 95.77.9.206
DAC 182.168.1.0/24 ether2 reachable distance 0 pref source 192.168.1.1
and on the other remote router:
this router it has 89.39.197.248/23 on eth1
it has 192.168.1.254/24 on eth2
/interface pptp-client add name=”pptp-tunnel1″ connect-to=95.77.9.206 user=”USERNAME” password=”PASS” profile=default-encryption add-default-route=no disabled=no
interface eoip add name=eoiptunnel remote-address=192.168.10.1 \ tunnel-id=101 disabled=no
interface bridge add name=bridge1
interface bridge port add bridge=bridge1 interface=ether1
/interface bridge port add bridge=bridge1 interface=eoiptunnel
on routes it has
AS 0.0.0.0/0 89.39.196.1 reachable bridge1 distance 1
DAC 89.39.196.0/23 bridge1 reachable distance 0 pref source 89.39.197.248
DAC 182.168.1.0/24 ether2 reachable distance 0 pref source 192.168.1.254
please help me ,
good day and happy holydays,
March 24th, 2011 at 10:08 pm
I need help with a configuration of two RB750G.
I try to make a connection like this post about EoIP-PPtP, but failed to establish the PPTP tunnel. There is no way to connect the tunnel. If you configure each router as a client to connect to another VPN (not MikroTik/RouterOS) the conecction can be done, but if configure one or the other router as the PPTP server can not connect clients with either a RB750G or Windows client.
Both RB750G are connected to the LAN ports of a router D-Link Dir 300, which provides internet service, only for setup and testing, then go with fixed IP on the Internet.
Left side (PPTP Server):
Router 1:
IP WAN (ether1): 192.168.0.51
Gateway: 192.168.0.1
LAN IP (ether2): 192.168.88.1
Tunnel IP EoIP (Local side): 192.168.10.1
PC 1:
IP: 192.138.88.10
Mask: 255.255.255.0
Gateway: 192.168.88.1
DNS: 192.168.88.1
Right side (PPTP client):
Router 2:
IP WAN (ether1): 192.168.0.52
Gateway: 192.168.0.1
LAN IP (ether2): 192.168.88.2
EoIP IP tunnel (Remote side): 192.168.10.2
PC 2:
IP: 192.168.88.12
Mask: 255.255.255.0
Gateway: 192.168.88.2
DNS: 192.168.88.2
Any PPP server that enable (PPTP (PPTP, L2TP, OVPN, or whatever) does not work. No client is able to connect.
I want to know what I’m doing wrong, because I follow the example of this blog and the MikroTik Wiki, but nothing works. I tried with RouterOS 4.17 and now 5.0rc11, but no way. The scripts are simmilar to this post.
I would appreciate any help on this case.
March 27th, 2011 at 9:33 pm
I had found a solution, you must open ports 1723 in TCP and UDP in the Firewall Filter Rules, uffff….!!!
March 28th, 2011 at 5:40 pm
Hi Alexandru MARIN. The correct line in the scrip is:
/interface bridge port add bridge=bridge1 interface=ether2
Look, ether2, not ether1. You are bridging the LAN interface (ether2) not the WAN interface (ether1). I had the same problem and when changed the script to ether2 it worked.
You must add two Firewall Filter Rules, in the PPtP server, the ports 1723 in TCP and UDP in the default configuration in the ether1-gateway, Chain: input, Protocol: 6 (tcp) and 17 (udp), Dst Port: 1723, Action: accept.
July 3rd, 2011 at 2:37 pm
Butch, I have a question: Why I can´t setup DHCP server in neither Mikrotik when I use transparent bridge using PPtP and EoIP?
This is the IP addresses list in the Mikrotik-2 that connect to the Mikrotik-1 pptp server:
Address Network Interfase
190.254.xxx.xx3/29 190.254.xxx.200 ether1-gateway
190.168.10.2 192.168.10.1 pptp-tunnel1
192.168.15.253/24 192.168.15.0 ether2-local-master
I can´t setup DHCP server in the Mikrotik-2 (or Mikrotik-1), when use WinBox interfase and I give the ether2-local-master and the IP 192.168.15.253, the DHCP server turn red and don´t work. Or when I configure it in terminal mode I receive those messages:
_____________________________________
[admin@MikroTik-2] > ip dhcp-server
[admin@MikroTik-2] /ip dhcp-server> setup
Select interface to run DHCP server on
dhcp server interface: ether2-local-master
Select network for DHCP addresses
dhcp address space: 192.168.15.0/24
Select gateway for given network
gateway for dhcp network: 192.168.15.253
If this is remote network, enter address of DHCP relay
There is no such IP network on selected interface
interrupted 192.168.15.253
[admin@MikroTik-2] /ip dhcp-server>
_____________________________________
Why?
October 20th, 2012 at 8:22 pm
hello
if i want to enter to local network mikrotik from normal pc in other internet network by vpn
In this case, what are the settings in mikrotik v3.30
thanks