Multiple EOIP with bridge. How to split traffick.

RouterOS General
1

Hi. Have similar setup as EOIP setup example hear. http://wiki.mikrotik.com/wiki/Testwiki/Virtual_Private_Networks
eoip.gif
In example there is Mikrotik A and B. My setup include Mikrotik C, D and E. All linking back to Mikrotik A with Mikrotik A having a DHCP and also acting as gateway for all the data. What i am trying to accomplish is to route traffic that is not part of the local subnet out the local interface (different gateway) instead of over the EOIP. In the example this would be over Ether2. Simple, yes? Big problem is that Ether 1 and EIOP is bridged and i can’t seem to find a way of doing this. Any ideas would be appreciated.

2

Either of:

  • Use .1 as the default gateway in LAN1 and .254 in LAN2
  • Setup mangle rules to route traffic directly to Internet for non local traffic.

There is many ways to do this. :slight_smile:

3

Thanks for the reply. That is what i thought as well, however because of the bridge it is not that easy. Also Mikrotik A give ip’s and is also the gateway. Did try to mark packages and route out ether 2 instead of EOIP, but you cant mark ether1 data. It is part of the bridge and the bridge just forward all data to the EOIP.

4

Mark “Use IP Firewall” in bridge settings.
If you want to you can filter the DHCP traffic from the EoIP tunnel with bridge filters and have DHCP servers on both sides.
Of course you need to split the IP scope between the sites.

5

Hi Peson.

Thanks.

Mark “Use IP Firewall” in bridge settings.

Is enabled.

If you want to you can filter the DHCP traffic from the EoIP tunnel with bridge filters and have DHCP servers on both sides.

Also did try this before. Did not actually function, because my filter, filtered DHCP on bridge, which is part of Ether1, braking DHCP on Ether1. Did not however try and fix it because i found the gateway has to be in the same network as ip range, which would any how defy the purpose.

6

Try this:

/interface bridge filter
add action=drop chain=forward comment="Drop BOOTP requests from inside to outside." disabled=no \
    dst-address=255.255.255.255/32 dst-port=67 in-interface=ether1 ip-protocol=udp mac-protocol=\
    ip out-interface=eoip src-address=0.0.0.0/32 src-port=68
add action=drop chain=forward comment="Drop BOOTP reply from inside to outside." disabled=no \
    dst-address=255.255.255.255/32 dst-port=68 in-interface=ether1 ip-protocol=udp mac-protocol=\
    ip out-interface=eoip src-address=0.0.0.0/0 src-port=67

//Paul