๐ ๏ธ EoIP not connecting: Tunnel troubleshooting checklist (MikroTik)
Published on 2025-10-16
The EoIP (Ethernet over IP) protocol from MikroTik is used to create an L2 tunnel over an IP network, allowing you to combine two remote local networks into a single broadcast domain.
If your EoIP tunnel does not establish (no “R” โ Running flag), follow this step-by-step checklist.
1. Check IP connectivity (L3)
Before starting, make sure the routers see each other at the IP level.
Ping the remote side:
/ping 203.0.113.2 count=4
If ping fails โ check routes and NAT:
/ip route print
/ip firewall nat print
Make sure there is a route to the remote IP and NAT is not translating GRE traffic.
Correct addresses:
Check that the remote-address field in the EoIP settings contains the correct WAN IP of the opposite router:
/interface eoip print
Example:
0 name="eoip-tunnel1" mtu=1476 arp=enabled remote-address=203.0.113.2 tunnel-id=0
2. Check EoIP tunnel configuration
Tunnel ID: Must match on both sides.
/interface eoip
add name=eoip-tunnel1 remote-address=203.0.113.2 tunnel-id=0
Local Address: If the WAN is not the primary one:
local-address=192.168.1.1
Check status:
/interface print
Example:
Flags: D - dynamic, X - disabled, R - running
# NAME TYPE MTU
0 R ether1 ether 1500
1 eoip-tunnel1 eoip 1476
If the R flag is missing โ the tunnel is not active.
3. Check Firewall (GRE and NAT) โ
Allow GRE:
/ip firewall filter
add chain=input protocol=gre action=accept comment="Allow GRE for EoIP"
Add this rule on both routers in the input chain.
NAT bypass: If EoIP is behind NAT or inside L2TP/IPsec, exclude it from SNAT:
/ip firewall nat
add chain=srcnat dst-address=203.0.113.2 action=accept comment="Bypass NAT for EoIP"
4. Check MTU (Maximum Transmission Unit) ๐
EoIP adds GRE and IP headers, reducing the allowable packet size.
Set MTU:
/interface eoip
set [find name=eoip-tunnel1] mtu=1400
Fragmentation diagnostic:
/tool ping 203.0.113.2 size=1500 do-not-fragment
If ping with do-not-fragment fails โ lower the MTU.
Recommended values:
- PPPoE โ 1300โ1400
- IPoE โ 1450โ1476
5. Check bridge and L2 connectivity
If the tunnel is up but traffic does not flow:
Add to bridge:
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=eoip-tunnel1
Ether2 โ local LAN, EoIP โ tunnel.
Check IP:
/ip address print
Make sure both sides are in the same subnet and there are no IP conflicts.
6. Diagnostics and logs
Logs:
/log print
Check messages related to GRE and EoIP.
Traceroute:
/tool traceroute 203.0.113.2
Use to verify the path to the remote router.
โ ๏ธ Common issues and solutions
| Problem | Cause | Solution |
|---|---|---|
| No R flag | No IP connectivity | Check ping, routes, NAT |
| Tunnel present but no traffic | EoIP not in bridge | Add to bridge with LAN |
| Intermittent drops | Provider blocks GRE / IP changes | Use IPsec or GRE over L2TP |
| Packet loss | MTU too big | Reduce MTU to 1400 or 1300 |
| One side behind NAT | GRE does not pass | Port forward or use L2TP/IPsec |
| Asymmetric routing | Path asymmetry | Configure policy routing |
| PPPoE without MSS-clamp | TCP session drops |
/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1360 passthrough=yes comment="Clamp MSS for EoIP"
``` |
| GRE not allowed | Firewall blocks GRE | Allow GRE in `input` and `forward` |
| No ARP | Wrong `local-address` or NAT | Specify correct WAN-IP |
---
## ๐ก Reliability tips
1. **Set MTU manually** โ avoid auto-detection.
2. **Netwatch monitoring:**
```bash
/tool netwatch add host=203.0.113.2 interval=1m up-script="/interface eoip enable eoip-tunnel1" down-script="/interface eoip disable eoip-tunnel1"
Use IPsec when operating over public networks.
Log GRE packets for diagnostics:
/ip firewall filter add chain=input protocol=gre action=log log-prefix="GRE-IN"
๐งฉ Summary
EoIP checklist:
- Check IP connectivity.
- Ensure
tunnel-idmatches. - Allow GRE in the Firewall.
- Check MTU.
- Add EoIP to the Bridge.
After fixes the interface should show the R (Running) flag and start passing traffic.