Link to Reddit thread: https://www.reddit.com/r/mikrotik/comme ... k_routers/

So an ISP wants me to set up a secure site-to-site VPN between A, B, C and ensuring redundancy such that A can reach C if B is down and so on.

Their Diagram


Router A, B, C all have public IP of the same subnet/prefix

They want to set up site-to-site in order to for the internal network of A, B, C to be accessible by each and any of the sites. For example, those in A can access B, those in B can access C and C and access A etc.

So what would be the optimal solution for this? Which VPN protocol can ensure good performance along with redundancy? I've looked at MikroTik docs/guides/forums but most of them only talk about IPSec with two sites.

I would definitely need some implementation examples/help on this one.

If you use the typical IPSec one... You can add a 3rd site pretty easily.

You can also check this example viewtopic.php?f=23&t=169538 that explains how to use IKE2 with 3 sites.

Not knowing the complex subject, I can only ask.......

Would it make sense to use MT proprietary Eoip tunneling and create a common network, or is that functionality only useful in a two site scenario??
https://help.mikrotik.com/docs/display/ROS/EoIP

Thread solved. IPIP tunnel + IPSec.

Hello i try to make a ipip tunel behind a router, which is the ipip port to fw ?