Ping does not work between endpoints over EOIP (L2 VLAN extension)

RouterOS Beginner Basics
1

Hi,

I am trying to extend VLANs at Layer 2 between Site A and Site B using EOIP, but traffic between endpoints in the same VLAN does not pass.

Environment

  • Device: MikroTik hEX

  • RouterOS: 6.49.18

  • EOIP tunnel between Site A and Site B

  • EOIP tunnel itself is up and MikroTik_A ↔ MikroTik_B can ping each other

Topology

PC_A1 - L3SW_A - MikroTik_A - L3SW_WAN - MikroTik_B - L2SW_B - PC_B1
PC_A2                                                          PC_B2

VLAN and IP configuration

  • VLAN10: 192.168.1.0/24

    • PC_A1, PC_B1

  • VLAN20: 192.168.2.0/24

    • PC_A2, PC_B2

L3SW_A configuration:

  • VLAN10 SVI: 192.168.1.254/24

  • VLAN20 SVI: 192.168.2.254/24
    These are used as default gateways for the PCs.

Problem

    • EOIP tunnel is established successfully

    • MikroTik_A can ping MikroTik_B

    • Ping between PC_A1 and PC_B1 fails

    • Same issue for VLAN20 (PC_A2 ↔ PC_B2)

EOIP configuration

MikroTik_A

/interface eoip
add name=eoip-tunnel2 tunnel-id=0 remote-address=192.168.10.1 \
    mac-address=02:70:xx:xx:xx:x1 keepalive=disabled

MikroTik_B

/interface eoip
add name=eoip-tunnel2 tunnel-id=0 remote-address=192.168.20.1 \
    mac-address=02:54:xx:xx:xx:x2 keepalive=disabled

Bridge configuration

MikroTik_A

/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=eoip-tunnel2

MikroTik_B

/interface bridge port
add bridge=bridge interface=ether2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge2 interface=ether1
add bridge=bridge2 interface=eoip-tunnel2

Additional notes

  • VLAN tagging is handled by the switches

  • EOIP is intended to carry VLAN trunk traffic

  • No special firewall rules for EOIP

  • FastTrack is not used

Question

Is this bridge configuration correct for passing VLAN traffic over EOIP?
What changes are required so that endpoints in the same VLAN can communicate across the tunnel?

Any advice would be appreciated.

2

This config would only join the devices that are on bridge1 and bridge2, not the devices on bridge.

1 Like
3

  1. Where is the rest of the configuration?

  2. You only "connected" MikroTik_A ether1 to MikroTik_B ether1 ...

4

Thanks for your comment.

You are right, I did not include the full configuration in my previous post.

Below is the current (sanitized) configuration of both MikroTik devices.

My main goal is to extend VLAN trunk traffic at Layer 2 over an EOIP tunnel,

so that multiple VLANs can pass without configuring each VLAN individually

on the MikroTik routers.

At the moment, I am trying to pass VLAN 10 and VLAN 20, but eventually

I would like to carry a full VLAN trunk transparently over EOIP.

Here is the full configuration.

Mikrotik_A

# model = RB750Gr3
/interface bridge
add admin-mac=F4:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridge
add name=bridge1
/interface eoip
add !keepalive local-address=192.168.101.1 mac-address=02:xx:xx:xx:xx:xx \
name=eoip-tunnel1 remote-address=192.168.101.2 tunnel-id=0
/interface vlan
add interface=ether5 name=vlan10 vlan-id=10
add interface=ether5 name=vlan20 vlan-id=20
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge1 comment=defconf interface=ether1
add bridge=bridge1 interface=eoip-tunnel1
add bridge=bridge interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.101.1/24 interface=ether1 network=192.168.101.0
/ip dhcp-client
# DHCP client can not run on slave interface!
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Mikrotik_B

# model = RB750Gr3
/interface bridge
add admin-mac=F4:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridge
add name=bridge2
/interface eoip
add !keepalive local-address=192.168.101.2 mac-address=02:xx:xx:xx:xx:xx \
name=eoip-tunnel2 remote-address=192.168.101.1 tunnel-id=0
/interface vlan
add interface=ether5 name=vlan10 vlan-id=10
add interface=ether5 name=vlan20 vlan-id=20
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge2 interface=ether1
add bridge=bridge2 interface=eoip-tunnel2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.2/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.101.2/24 interface=ether1 network=192.168.101.0
/ip dhcp-client
# DHCP client can not run on slave interface!
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

My intention is to use EOIP as an L2 tunnel to carry VLAN trunk traffic

between the two sites.

Is my bridge design incorrect for this purpose?

Should EOIP and the trunk port (ether5) be in the same bridge?

Also, is there a better or simpler way to pass multiple VLANs over EOIP

without creating individual VLAN interfaces on the MikroTik routers?

5

Yes and Yes.