Cannot pass traffic across EOIP bridge?

RouterOS General
1

I’m trying to a setup a portable mikrotik box, to allow myself L2 connectivity to my LAN from remote networks. I have done this several years ago, but have lost the configs of how I set it up.
Here’s what I have so far.

Router 1 - x86
ether1 - static public IP
ether2 - no IP, connected directly to private LAN
L2TP/IPsec with IP of 10.10.10.1
EOIP tunnel connected to 10.10.10.2
bridge1 with ether2 and EOIP tunnel as ports

Router 2 - RB951
ether1 - dynamic IP address from random ISP
L2TP/IPsec with IP of 10.10.10.2
EOIP tunnel connected to 10.10.10.1
bridge1 with EOIP and ether5 as ports

L2TP/IPsec works and secures a link between both routers, giving static ip’s to work with on the EOIP tunnel. The tunnel works fine. I can even run torch on ether5 on Router 2, and see broadcast traffic from my private LAN.

Everything works up until I try to pass traffic back to my private LAN from Router 2. I can get an IP address from my LAN’s dhcp server on Router 2/ether5 if I plug a laptop into it. But, I can not pass any other traffic. Trying to ping the gateway from a laptop connected to Router 2/ether5, yields request timed out. I have eliminated any filter rules causing an issue, by disabling all on both routers with no luck. I’ve disabled fastpath on the EOIP tunnel.

I’m not sure what I’m missing here; I’ve gotten this to work in the past, but, just can’t make it work again.

2

Hi,

Can you ping 10.10.10.1 from the remote side?

I think your issue may be MTU related

3

Why would you want to run EoIP over L2TP over ipsec.
Just run EoIP directly over Ipsec, this will avoid unnecessary overhead and setup complication.

4

Well, fixed the issue. After beating my head against the wall some more, I finally stumbled across this thread http://forum.mikrotik.com/t/bridging-eoip-tunnnel-problem/49634/1

All I had to do was set Promiscuous Mode to “accept” on the vSwitch properties, and voila, it’s working like it should.

So, moral of the story, if you’re virtualizing RouterOS on esxi, you’ll need to allow promiscuous mode on the host’s vSwitch.