LAN VPN over EOIP doesn't work

RouterOS General
1

I have two MikroTik routers in different physical locations, with different public IPs. I want to distribute a single LAN IP address range between them (e.g., 192.168.1.0/24) such that LAN devices on either router will be able to see all the other devices on the same LAN, regardless of which router they are connected to. Each LAN device will use its local router’s address (192.168.1.1 or 192.168.1.2) as the gateway to the greater internet, to avoid swamping the inter-router link with needless traffic. The inter-router traffic between LAN devices will in fact be very low volume, it just has to work.
VPN graphic 2009.jpg
I followed all the directions in http://www.mikrotik.com/testdocs/ros/2.9/interface/eoip.php under “EOIP Application Example” to set up a LAN VPN over EOIP, including bridging the EOIP tunnel with the LAN interfaces. The PPTP link works fine, but the EOIP tunnel doesn’t seem to do anything. From either router I can successfully ping the gateway address of the other router (which I believe is a PPTP function), but I can’t ping any LAN devices on the other router.

The document says if your EOIP tunnel doesn’t work, make sure the artificial MAC addresses are different, which they are – but it doesn’t offer any more help than that. I tried using logging to see what the problem was, but there doesn’t seem to be a category for EOIP.

I had this same problem a couple years ago, and it suddenly started working when I changed something from arp=enabled to arp=proxy-arp (I was rattling around trying anything I could think of). But I don’t remember exactly what setting I changed, none of the pages that talk about tunneling even hint that you should do this, and from what I have since learned about what proxy-arp means, I can’t imagine that it was ever the right thing to do.

Where should I start in order to debug this issue?

2

What do you have in /interface bridge export?

3

After a long time reviewing the configuration, I found the problem: /ip address had been applied to the interface alone, and not to the bridge. When I fixed that error, the tunnel worked, and I could ping any LAN device successfully from either router.

But I ran into one more issue.

As a user logged in over a PPTP VPN, I could not directly ping anything but my own local and remote addresses and the router’s internal gateway address. (This even included not being able to ping LAN devices on the same router as my PPTP server, never mind the other router.)

I managed to make the entire LAN pingable from the remote PPTP user by changing arp=enabled to arp=proxy-arp on both the bridge and the tunnel, but I suspect this is more a hack than a solution.

Is there a more straightforward or elegant way of making this work?