IPIP (IPencap) tunnel has the least overhead of the three. If you encrypt it using IPsec in transport mode, it has the same overhead as IPsec in tunnel mode. GRE in the Mikrotik vernacular is actually “IP over GRE”, whereas EoIP is a proprietary “Ethernet over GRE”; as compared to IPIP, the “real” GRE has additional fields - one indicating the actual type of encapsulation and another one bearing a distinctive tunnel ID, which allows you to create multiple tunnels with same encapsulation type between the same pair of peers. Much like TCP/UDP ports but not exactly the same. Unfortunately, Mikrotik’s IP over GRE doesn’t use these distinctive fields, and Mikrotik’s Ethernet over GRE misuses them in such a way that even firewalls that can work with the 4-byte tunnel ID get confused.
An advantage of “something over IPsec” as compared to bare IPsec is that you can use the regular routing rather than IPsec policies. IPsec policies quickly turn into a nightmare in more complex network topologies, and dynamic routing protocols allowing routing redundancy can also only work in conjunction with “something over IPsec”. The maximum redundancy provided by bare IPsec is the “client” connecting to two “servers” simultaneously, and the actual tunnels (security associations) migrating between the two “servers”, where only one SA is active at a time. So no “full mesh” topologies are possible with IPsec.
