Mikrotik RouterOS transparent bridge using PPtP and EoIP

In this article, I want to describe how to tunnel EoIP over a PPtP connection.  EoIP is a Mikrotik specific method of bridging ethernet traffic over a routed network.  The problem with using EoIP as a “VPN”, is that it is not encrypted.  The network we will build in this article will tunnel the EoIP traffic over an encrypted PPtP tunnel.  There are other methods available in later versions of Mikrotik RouterOS to accomplish this functionality (OpenVPN, for one example) and I will be adding articles on some of these at a later time.  the method described in this article will work in any version of Mikrotik RouterOS.  It has been tested under 2.8.28, 2.9.51 and 3.13.

The following picture is the network layout we are shooting for:

Our goal is the build a transparent bridge over the internet. This article gives a brief how-to describing the steps necessary to accomplish this. The PPtP tunnel is only needed in order to add encryption, since EoIP is not an encrypted tunnel.

In this configuration, there are several parts, which we will discuss individually. First, there is the IP space on both the internet side of each router and the “private” side. Note that the PRIVATE range is the SAME on both sides. This is not important for the tunnel to work, but one of the purposes of EoIP is to bridge networks in this way. It should, also, be noted that a DHCP server on either end of the tunnel will be “seen” by equipment at both ends of the tunnel.

The bridge interface on both ends includes the EoIP tunnel and the ethernet port that is plugged into the private network. This will be discussed in further detail in a few paragraphs.

To begin our config, we will first build the PPtP tunnel. We will set the left router (12.12.10.2) as the PPtP server and the right router (12.21.11.1) as the client.

Left router:

/interface pptp-server server set enabled=yes

/ppp secret
add name="USERNAME" service=pptp password="PASS" \
local-address=192.168.10.1 remote-address=192.168.10.2  \
disabled=no 

The above configuration is all that is needed on the left router. It should be noted that the IP range I chose for the tunnel is NOT in the same range as the LAN segments. This is not strictly needed, but it is good network design, since these interfaces will NOT be added to the bridge.


Right Router:

/interface pptp-client
add name="pptp-tunnel1" connect-to=12.12.10.2 \
user="USERNAME" password="PASS" \
profile=default-encryption add-default-route=no \
disabled=no 

This is the full configuration needed for the tunnel on the right router. The profile section is a default setting, but I generally specify it anyway.

The PPtP tunnel is now set up and you should see the tunnel as running on both ends. You can see the tunnel interface in Winbox under “Interfaces” and “PPP->Interfaces”.  If you wish the see the IP addresses, you can see that under “IP->Addresses”.

Now we need to add the EoIP tunnel. This is the same on both ends, with the exception of the IP address we are connecting to.

LEFT:
/interface eoip add name=eoiptunnel remote-address=192.168.10.2 \
tunnel-id=101 disabled=no

RIGHT:
/interface eoip add name=eoiptunnel remote-address=192.168.10.1 \
tunnel-id=101 disabled=no

It is very important that the tunnel-id parameter be the same on both ends.

Next, we will add the bridge (this is the same on both ends):

/interface bridge add name=bridge1

Hard to believe it’s that easy, but it is.

Next, we set up the bridge ports. We will assume that the LAN side of the Mikrotik routers are the ether1 interface.

/interface bridge port add bridge=bridge1 interface=ether1
/interface bridge port add bridge=bridge1 interface=eoiptunnel

The name eoiptunnel is the “name” parameter we used in the configuration we did above for the tunnel setup.

That’s it for the config. It is very easy to set up this type of config. There are a couple of other notes I will make, but as far as the configuration on the Mikrotik, that’s about it.

Devices on the right router should use 192.168.1.254 as their default gateway. They will be able to see the 192.168.1.1, but if you use that as a default gateway for these devices, then ALL their traffic will go across the bridge. This may be your desire, but it is important to note this fact. (Reverse the above for devices on the left router.)

I’ve already mentioned the DHCP server. Note that IP addresses cannot be duplicated on either network. The EoIP tunnel will act just like a (very long) ethernet cable plugged into a switch at both ends of the tunnel. You are, literally, joining the 2 networks into ONE network.

I hope I haven’t missed anything. If so, I am sure someone will point this out. :-)  I hope you find this article useful.

12 Responses to “Mikrotik RouterOS transparent bridge using PPtP and EoIP”

  1. bukkieboy Says:

    Hello

    I bought a VPN access and I have been able to connect it to a windows OS and successfully shared it on my local network (about 4 computers) and it worked fine i was hoping I would be able to do the same on the mikrotik, I has been able to connect the mikrotik to the VPN network but I dont know how to share over the net work

    Please could you reply

    thanks

  2. Butch Evans Says:

    This depends a little on how your access works. I’m assuming that it works via a PPtP connection. If that is the case, then I suspect that the reason it is not working is either related to your NAT rule or default route. This isn’t really the place to troubleshoot these things, but you can find my contact information at my consulting website at http://www.butchevans.com/

  3. Interligar redes físicas independentes apenas para um IP! Says:

    […] redes físicas independentes apenas para um IP! GA_googleFillSlot("300×250-forum-fistpost"); Mikrotik RouterOS transparent bridge using PPtP and EoIP | Butch Evans Blog Celso Domingues Consultoria técnica em TI Tel.: +55 71 9957-3698 سوف يوفر اليسوع […]

  4. doublecaps Says:

    Great illustration. It works flawlessly.

    I need to implement EoIP over PPtP to connect 70 stores to corporate offices. Do I need to create 70 different tunnels or can I point all the routers at the remote sites to the same EoIP tunnel @ corporate office?

  5. Butch Evans Says:

    Are you wanting to have all 70 stores on the same subnet? If not, then you only need the 70 pptp tunnels. If you DO need them all on the same subnet, then you would need to have one pptp/eoip tunnel per store.

  6. Rede roteada nao acessa uma rb no meio da rede Says:

    […] via radius. com a rede roteada e autenticação direto no servidor teria de fazer isso: Mikrotik RouterOS transparent bridge using PPtP and EoIP | Butch Evans Blog qualquer coisa estamos ai… clica na estrelinha pra agradecer. Citar + […]

  7. Alexandru MARIN Says:

    hello,
    can’t ping the remote computers with the one’s on the other side

    i am new in setting up mikrotik routerboard, and i need some help. I have made all setting according to what you have wrote,I have tryed to bridge two networks, but i don’t know where did i go wrong, i have 2 rb750, and i can’t ping the computers from one side to another. the config i have made on each router, in the winbox it shows that there are conected to each other but still i can’t ping each them, i want from two computers on one side i could ping the other computers on the other side. if i am conected through telnet on the server router i can ping the ISP public adresses (95.77.9.206/24 and 89.39.197.248/23)the adresses i have received from my ISP’s, and can ping the tunnel private adresses 192.168.10.1 and 192.168.10.2, but i can not ping the private adresses 192.168.1.2 attached to the computers i work with on one side with the 192.168.1.3 from the other.
    I haven’t modified anything in firewall or other rules, just setting up the internet connection and the settings above.
    on one server router i have :

    this router has the ip adress 95.77.9.206/24 on eth1
    ip adress 192.168.1.1/24 on eth2

    /interface pptp-server server set enabled=yes
    /ppp secret
    add name=”USERNAME” service=pptp password=”PASS” local-address=192.168.10.1 remote-address=192.168.10.2 disabled=no
    /interface eoip add name=eoiptunnel remote-address=192.168.10.2 tunnel-id=101 disabled=no
    /interface bridge add name=bridge1
    /interface bridge port add bridge=bridge1 interface=ether1
    /interface bridge port add bridge=bridge1 interface=eoiptunnel

    on routes it has
    AS 0.0.0.0/0 95.77.9.1 reachable bridge1 distance 1
    DS 0.0.0.0/0 89.137.205.193 reachable bridge1 distance 1
    DAC 95.77.9.0/24 bridge1 reachable distance 0 pref source 95.77.9.206
    DAC 182.168.1.0/24 ether2 reachable distance 0 pref source 192.168.1.1

    and on the other remote router:
    this router it has 89.39.197.248/23 on eth1

    it has 192.168.1.254/24 on eth2

    /interface pptp-client add name=”pptp-tunnel1″ connect-to=95.77.9.206 user=”USERNAME” password=”PASS” profile=default-encryption add-default-route=no disabled=no
    interface eoip add name=eoiptunnel remote-address=192.168.10.1 \ tunnel-id=101 disabled=no
    interface bridge add name=bridge1
    interface bridge port add bridge=bridge1 interface=ether1
    /interface bridge port add bridge=bridge1 interface=eoiptunnel

    on routes it has

    AS 0.0.0.0/0 89.39.196.1 reachable bridge1 distance 1
    DAC 89.39.196.0/23 bridge1 reachable distance 0 pref source 89.39.197.248
    DAC 182.168.1.0/24 ether2 reachable distance 0 pref source 192.168.1.254

    please help me ,
    good day and happy holydays,

  8. Jagugo Says:

    I need help with a configuration of two RB750G.

    I try to make a connection like this post about EoIP-PPtP, but failed to establish the PPTP tunnel. There is no way to connect the tunnel. If you configure each router as a client to connect to another VPN (not MikroTik/RouterOS) the conecction can be done, but if configure one or the other router as the PPTP server can not connect clients with either a RB750G or Windows client.

    Both RB750G are connected to the LAN ports of a router D-Link Dir 300, which provides internet service, only for setup and testing, then go with fixed IP on the Internet.

    Left side (PPTP Server):

    Router 1:
    IP WAN (ether1): 192.168.0.51
    Gateway: 192.168.0.1
    LAN IP (ether2): 192.168.88.1
    Tunnel IP EoIP (Local side): 192.168.10.1

    PC 1:

    IP: 192.138.88.10
    Mask: 255.255.255.0
    Gateway: 192.168.88.1
    DNS: 192.168.88.1

    Right side (PPTP client):

    Router 2:
    IP WAN (ether1): 192.168.0.52
    Gateway: 192.168.0.1
    LAN IP (ether2): 192.168.88.2
    EoIP IP tunnel (Remote side): 192.168.10.2

    PC 2:

    IP: 192.168.88.12
    Mask: 255.255.255.0
    Gateway: 192.168.88.2
    DNS: 192.168.88.2

    Any PPP server that enable (PPTP (PPTP, L2TP, OVPN, or whatever) does not work. No client is able to connect.

    I want to know what I’m doing wrong, because I follow the example of this blog and the MikroTik Wiki, but nothing works. I tried with RouterOS 4.17 and now 5.0rc11, but no way. The scripts are simmilar to this post.

    I would appreciate any help on this case.

  9. Jagugo Says:

    I had found a solution, you must open ports 1723 in TCP and UDP in the Firewall Filter Rules, uffff….!!!

  10. Jagugo Says:

    Hi Alexandru MARIN. The correct line in the scrip is:

    /interface bridge port add bridge=bridge1 interface=ether2

    Look, ether2, not ether1. You are bridging the LAN interface (ether2) not the WAN interface (ether1). I had the same problem and when changed the script to ether2 it worked.

    You must add two Firewall Filter Rules, in the PPtP server, the ports 1723 in TCP and UDP in the default configuration in the ether1-gateway, Chain: input, Protocol: 6 (tcp) and 17 (udp), Dst Port: 1723, Action: accept.

  11. Jagugo Says:

    Butch, I have a question: Why I can´t setup DHCP server in neither Mikrotik when I use transparent bridge using PPtP and EoIP?

    This is the IP addresses list in the Mikrotik-2 that connect to the Mikrotik-1 pptp server:

    Address Network Interfase
    190.254.xxx.xx3/29 190.254.xxx.200 ether1-gateway
    190.168.10.2 192.168.10.1 pptp-tunnel1
    192.168.15.253/24 192.168.15.0 ether2-local-master

    I can´t setup DHCP server in the Mikrotik-2 (or Mikrotik-1), when use WinBox interfase and I give the ether2-local-master and the IP 192.168.15.253, the DHCP server turn red and don´t work. Or when I configure it in terminal mode I receive those messages:

    _____________________________________
    [admin@MikroTik-2] > ip dhcp-server
    [admin@MikroTik-2] /ip dhcp-server> setup
    Select interface to run DHCP server on

    dhcp server interface: ether2-local-master
    Select network for DHCP addresses

    dhcp address space: 192.168.15.0/24
    Select gateway for given network

    gateway for dhcp network: 192.168.15.253
    If this is remote network, enter address of DHCP relay

    There is no such IP network on selected interface
    interrupted 192.168.15.253
    [admin@MikroTik-2] /ip dhcp-server>
    _____________________________________

    Why?

  12. hitham_adel2004 Says:

    hello
    if i want to enter to local network mikrotik from normal pc in other internet network by vpn
    In this case, what are the settings in mikrotik v3.30
    thanks

Leave a Reply

You must be logged in to post a comment.