Configuring EoIP Tunnel Between MikroTik and Keenetic: Bridging Networks Over Private IPs

Sometimes two remote local networks need to be combined so they work as one: devices see each other by MAC addresses and broadcast requests pass through. For this MikroTik has EoIP (Ethernet over IP) — a layer-2 tunnel over an IP network.

Keenetic can also do EoIP: for this in KeeneticOS you need to install the “EoIP tunneling” component (General settings → Updates and components → Edit component set). The manufacturer explicitly states that EoIP was developed by MikroTik and is compatible with its implementation.

Since 2025 in Russia routers of this platform are sold under the Netcraze brand (OOO Netcraze, formerly OOO Keenetic), models NC-xxxx; the firmware is the same — NDMS, so everything described also applies to them.

Below — configuration of a tunnel between MikroTik and Keenetic over private addresses: this way the tunnel runs over an already existing VPN between the routers. If EoIP is needed directly over the Internet, both routers must have public addresses and there must be no NAT between them; in that case you should protect the tunnel with IPsec (see below).

📌 What is EoIP?

EoIP (Ethernet over IP) is MikroTik’s tunneling protocol that uses GRE as transport (IP protocol 47). It transmits entire Ethernet frames, so any layer-2 traffic passes through the tunnel: ARP, DHCP, PPPoE, IPv6, VLAN.

Keep three important properties of EoIP in mind:

• no encryption or authentication — for use over the Internet you need IPsec;
• no NAT between endpoints — both routers must see each other directly (or by addresses inside a VPN);
• the tunnel does not keep connection state — an “up” interface does not yet mean data flows; check with ping.

📋 Requirements for successful operation

Before starting configuration, make sure the following key conditions are met:

• Availability by IP without NAT between endpoints: routers must see each other directly — by public addresses or inside a common VPN (for example, both connected to the same VPN server or a site-to-site VPN is already established between them). The tunnel does not work through NAT without IPsec: GRE has no ports to forward.
• Use of private IP addresses: In our example we will use private IPs for tunneling. Suppose:
  • MikroTik: 192.168.100.1 (IP that MikroTik uses to reach Keenetic).
  • Keenetic: 192.168.200.1 (IP that Keenetic uses to reach MikroTik).
• Matching Tunnel ID: the tunnel identifier must be the same on both devices (Keenetic accepts values from 1 to 65535; in the example — 100).
• No GRE (IP Protocol 47) blocking: Ensure that no firewall or provider blocks the GRE protocol.

🖧 Our network diagram

Consider the following topology:

[Local network A] <--- Ethernet ---> MikroTik (tunnel IP: 192.168.100.1)
                                      ↑
                                      | EoIP Tunnel (Tunnel ID: 100)
                                      ↓
[Local network B] <--- Ethernet ---> Keenetic (tunnel IP: 192.168.200.1)

We’ll create a shared EoIP network for direct L2 interaction between the routers, e.g. 192.168.88.0/24.

⚙️ MikroTik (RouterOS) configuration

Connect to your MikroTik router (via Winbox or SSH/WebFig) and run the following commands:

1. Create the EoIP interface: This interface will be the virtual channel for our tunnel.

   routeros Copy

   /interface eoip add name=eoip-keenetic \
     remote-address=192.168.200.1 \
     local-address=192.168.100.1 \
     tunnel-id=100 comment="EoIP tunnel to Keenetic"

   • remote-address: IP address of Keenetic used for the tunnel.
   • local-address: IP address of MikroTik from which tunnel packets are sent.
   • tunnel-id: tunnel identifier, must match on both sides.

   By default the RouterOS EoIP interface has mtu=auto, clamp-tcp-mss=yes (TCP MSS size is adjusted automatically) and keepalive=10s,10.

2. Create a bridge and add ports: We’ll create a new bridge to combine our EoIP interface with the MikroTik local network, making them part of one L2 domain.

   routeros Copy

   /interface bridge add name=br-eoip comment="Bridge for EoIP tunnel"
   /interface bridge port add bridge=br-eoip interface=eoip-keenetic comment="Add EoIP interface to bridge"
   /interface bridge port add bridge=br-eoip interface=ether2 comment="Add MikroTik LAN port (or VLAN) to bridge"

   • Replace ether2 with the name of your LAN port or VLAN interface that you want to include in the L2 domain with Keenetic.

3. Assign an IP address to the bridge (optional, for L3 access): If you need an IP address to manage the bridge or for routing L3 traffic through it, assign one. This will be your MikroTik IP in the shared EoIP network.

   routeros Copy

   /ip address add address=192.168.88.1/24 interface=br-eoip comment="IP for EoIP bridge"

   • 192.168.88.1/24 — this is the MikroTik IP in our new shared L2 network.

⚙️ Keenetic (NDMS) configuration

The commands below correspond to the Keenetic article “Setting up IPIP, GRE and EoIP tunnels via CLI”. Open the router command line (web interface → Command Line or SSH/Telnet).

1. Create the EoIP interface:

   cli Copy

   (config)> interface EoIP0
   (config-if)> tunnel destination 192.168.100.1
   (config-if)> tunnel eoip id 100
   (config-if)> up
   (config-if)> exit

   • tunnel destination: the address of the MikroTik to which the tunnel is built.
   • tunnel eoip id: the tunnel identifier, matches tunnel-id on MikroTik.

2. Include EoIP in the Home segment. To combine networks at layer 2, configure the EoIP interface without an IP address and include it in the Home bridge segment:

   cli Copy

   (config)> interface Home
   (config-if)> include EoIP0
   (config-if)> exit
   (config)> system configuration save

   After this, devices behind MikroTik and behind Keenetic will be in the same broadcast domain. The addressing of the two networks must be coordinated: one shared subnet and one DHCP server (or static addresses). Keenetic documentation explicitly recommends using static addresses on devices when merging networks via EoIP: otherwise DHCP requests will go into the tunnel and receive an address from the server on the other side.

3. Variant without a bridge — a layer-3 tunnel. If you only need router-to-router connectivity, you can assign an address to the EoIP interface, as shown in the documentation example:

   cli Copy

   (config)> interface EoIP0
   (config-if)> ip address 192.168.88.2 255.255.255.0
   (config-if)> security-level private
   (config-if)> exit
   (config)> system configuration save

   If traffic between private interfaces (for example, Home and EoIP0) must pass, run no isolate-private: by default KeeneticOS isolates such interfaces from each other.

✅ Tunnel testing

After configuring both sides, verify that the tunnel works correctly.

On MikroTik:

• Check EoIP interface status:
  routeros Copy

  /interface eoip print

  The R (running) flag next to eoip-keenetic depends on keepalive; the main indication of a working tunnel is successful pings and traffic.
• Ping the Keenetic IP in the EoIP network:
  routeros Copy

  /ping 192.168.88.2 interface=br-eoip

  Pings should succeed.
• Traffic through the tunnel (torch):
  routeros Copy

  /tool torch interface=eoip-keenetic

  This will show traffic passing through the tunnel, if any.

On Keenetic:

• Check the interface state:
  cli Copy

  show interface EoIP0

  The interface should be up. Keenetic documentation reminds that EoIP does not keep connection state, so the tunnel’s operation is checked with ping; you can also set up a Ping Check on the EoIP interface.
• Ping the MikroTik IP in the EoIP network:
  cli Copy

  ping 192.168.88.1

  Pings should succeed.

🛠️ Possible problems and solutions

• Tunnel does not work (status “down”):
  • Check the Tunnel ID: it must be the same on both ends.
  • Check the component on Keenetic: without the “EoIP tunneling” component the EoIP0 interface will not be created.
  • Check remote-address and local-address: make sure they are set correctly and the routers can ping each other at these addresses. remote-address on MikroTik should be the Keenetic local-address, and vice versa.
• No connectivity through the tunnel, although interfaces are UP:
  • Check GRE (IP protocol 47) allowance: ensure your firewalls on both routers (and any intermediate firewalls) allow IP protocol 47.
  • NAT between routers: EoIP without IPsec does not work through NAT. Build the tunnel over an existing VPN or use EoIP with IPsec: on Keenetic, when the “IPsec VPN” component is installed, commands ipsec preshared-key and ipsec ikev2 are added, and IPsec itself handles traversal through NAT (NAT-T, UDP 500/4500). On MikroTik there is an ipsec-secret parameter for EoIP; compatibility of automatic IPsec between vendors should be checked on your firmware versions.
• MTU (Maximum Transmission Unit) issues:
  • Sometimes packet fragmentation issues may occur, especially if EoIP is tunneled through a VPN or the Internet.
  • Solution: both vendors calculate tunnel MTU automatically, but you can set it manually, for example to 1400, on both ends:
    • MikroTik: /interface eoip set eoip-keenetic mtu=1400
    • Keenetic: interface EoIP0 → ip mtu 1400
    • On MikroTik clamp-tcp-mss=yes is enabled by default for EoIP, so a separate change-mss rule in mangle is usually not required. Step-by-step tunnel diagnostics — see the article 🛠️ EoIP not connecting: Tunnel troubleshooting checklist (MikroTik).

🧩 When is this useful?

• Merging networks into a single L2 domain: allows computers in different physical locations to be in the same subnet, obtain DHCP addresses from a single server, and work with broadcast traffic.
• Passing VLAN, DHCP, PPPoE between locations: EoIP is ideal for extending VLANs, transparent DHCP operation, or even passing PPPoE sessions through the tunnel.
• Building redundant infrastructure over a VPN: you can use EoIP over a VPN to create resilient solutions.
• Simple access to devices in a remote network: if you need L2 access to devices that have no IP addresses or that must be in the same L2 network.

💬 Conclusion

EoIP between MikroTik and Keenetic lets you merge two networks into a single layer-2 domain. The tunnel is simple but does not encrypt data and does not traverse NAT, so it is deployed over a VPN or protected with IPsec. Which VPN servers and clients are available in Keenetic are covered in the articles Keenetic as a VPN server and Keenetic as a VPN client.