EoIP config help needed

RouterOS General
1

Hi, Im trying to setup an EoIP tunnel as shown in the diagram attached, please assist. I have tried the basic setup using the WAN IPs (Public static IPs) as Local and Remote address but with no luck. Firstly the EoIP does not even show that its running when i setup on one end..or is it even the right way to do it? I need to be able to access devices on Site B from Site A

Thanks
EoIP Tunnel.jpg

2

Your MT devices are behind a NATed device, so will not work.

You either need to put fiber routers which I suspect is ONU/ONT’s, in bridge mode or configure port forwarding on them if that is possible

3

I have tried port forwarding port 47 and 1723 on the fiber routers on both sides but still wont work. I have also put the MT routers in DMZ on the fiber routers still with no luck. Are you able to provide me with a more detailed config method please?

4

GRE is not port 47. Port forwarding usually expects it will be TCP/UDP protocol, where ports have some meaning.
GRE is different protocol: https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers
Some simple devices don’t give you option to forward whole protocol, only TCP/UDP ports.

5

Thanks for the info. Should placing the MT routers in DMZ then work? I have tried it but i still don’t get a link.

6

To be honest, I don’t know - never tried it. I believe it should work, if it is implemented correctly. However, I don’t know how to determine which ports/protocols are really forwarded on your devices into DMZ.
Just to make sure

  • when you had your mikrotik’s in DMZ, your EOIP remote-addr on each mikrotik was the WAN IP of the opposite site, right?
  • did you use ipsec? If yes, then whole GRE communication gets encapsulated into IPsec (Again, not every device can forward it and I don’t know if it will work on your DMZ)
  • what about packet sniffer? When I debugged EOIP on my network, I started sniffer on Protocol 47 on both routers and then I saw if packets are properly Transmitted (correct IP etc..) and received (if it reach the target device or not)

Ideal would be to have your fibre routers in bridge mode as CZfan suggested. Then you will get public IP and completely transparent communication directly on your mikrotik.