Hello! My ISP provides static public IP via SNAT on their NAS. GRE and all other services work seemlessly. However, I cannot get EoIP tunnels working. Can someone elaborate what protocol/port is EoIP based on. It is proving to be a limiting factor for mikortik devices in our network. They use IPACCT radius and NAS solution.
EoIP is a proprietary application atop GRE (i.e. IP protocol number 47, no ports), and it misuses the optional 4-byte tunnel ID header as a 2-byte EoIP tunnel ID and 2-byte frame length, so firewalls distinguishing GRE tunnels from one another to allow NATing of more than one tunnel to the same remote destination get confused by this (as the GRE tunnel ID differs for packets belonging to the same tunnel).
But there may be also some other reason, like NAT/firewall on your router itself. So see what /ip firewall connection print detail where protocol~“gre” shows. If you can see s or d among the flags, this may be the reason why it fails. Even Mikrotik’s own firewall has some funny issues with EoIP on some CPU architectures. You may also use /tool sniffer ip-protocol=gre to watch which direction fails. Keepalive must be activated at both ends so that you could see something.
If the reason is the firewall/NAT at the ISP, you may need to use IPsec to encapsulate EoIP into ESP and UDP.
It’s funny that you say that the fact that EoIP doesn’t work is a limiting factor for use of Mikrotik, given that EoIP is Mikrotik’s proprietary protocol (which does not mean that other routers don’t support other types of tunnels capable to transport L2 frames).
Actually mikrotik doesn’t support VxLAN in v6 and in v7 its multicast based and not unicast. So if EoIP doesn’t work then we cannot use Mikrotik. Other end supports only VxLAN and EoIP.
If so, you have to investigate into the actual reason why it fails, using the steps I’ve suggested above.
Still EoIP doesn’t work even if one endpoint is behind IPACCT based ISP NAS.