Hi everyone,

I recently purchased a L009 router that I'm very happy with. I'm doing some new wiring in the building and I would like to set up an encrypted link to cross a public space, to reach another router. I would like the two local networks to be in the same L2 domain, and as it turns out this is quite the textbook scenario: https://help.mikrotik.com/docs/display/ ... IP-Example

This is the physical setup I have in mind:
Between the the two routers I'd have an EoIP tunnel with IPSec. Now I'm asking myself how can I tell the router that:

• eth02 should not send LAN traffic on the link
• eth02 should be used exclusively for the EoIP tunnel, and require an EoIP peer to run
• the tunnel running on eth02 must connect back to the LAN bridge, where the rest of the local traffic happens

The first point is quite easy as I'd just remove eth02 from the bridge, but I can't figure out how I can ensure that no traffic but the tunnel runs on that same interface.
Would this be as simple as assigning the local tunnel IP to eth02, and add the tunnel interface to the existing LAN bridge?

I'm sure I'm making this more complicated than it needs to be, and I apologize if this is something trivial. I would like to understand what I'm doing before applying any change.
Thanks!

You're afraid someone is hacking into your ethernet inside your own LAN ??

How it might be solved (I think, I need to test it myself):
- remove eth2 from L009 bridge
- assign new subnet with /30
- remove eth1 from RB2011 bridge
- assign other address from same subnet as point 2
- create on both sides EOIP tunnel from address 1 to address 2
- attach EOIP tunnel on both ends to bridge
Same L2 should be obtained.

Ok, so it was easier than I thought. I'll try this out when I have a bit of spare time.

You're afraid someone is hacking into your ethernet inside your own LAN ??

Nah, it's more for fun and to learn something new really.

Thank you.

Just tested it on my lab setup between Hex and AX2.
Works as indicated.

Tested this solution and worked great. To recap for the next soul stumbling upon this thread:

• Remove router-1/interface-1 from the LAN bridge
• Assign a /30 IP to the interface
• Create the EoIP tunnel with the assigned IP as source and its next host IP as remote
• Add the tunnel to the LAN bridge
• Repeat for the second router

Thanks holvoetn for the quick answer!