MikroTik + Keenetic: FAQ and Step-by-Step Diagnostics

This article is compiled as a “cheat sheet” for SOHO/SMB networks: common issues, their symptoms, causes, quick fixes, and diagnostic checklists. Suitable for both engineers and admins who maintain the MikroTik ↔ Keenetic bundle.

📑 Navigation

• EoIP “freezes” when transferring large files
• Site-to-Site VPN is up, but traffic doesn’t pass
• NAT breaks VPN/EoIP
• MTU/MSS: how to choose correctly
• Policy Routing (RouterOS 7)
• SMB from another subnet doesn’t work
• Quick diagnostics checklist
• Command cheat sheet
• Typical MTUs for tunnels
• NAT/Firewall exceptions matrix
• Common pitfalls
• Visualizations
• Resources and documentation

1) EoIP “freezes” when transferring large files

Symptoms: SMB/FTP hangs, speed fluctuates, RDP drops. Causes: incorrect MTU/MSS, fast-path with IPsec, NAT/Firewall errors.

⚡ Quick fix (MikroTik):

/interface eoip add name=eoip-tun remote-address=203.0.113.1 tunnel-id=10 mtu=1476 clamp-tcp-mss=yes
/ip firewall mangle add chain=forward action=change-mss new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
/interface ethernet set [find] allow-fast-path=no

Keenetic (CLI):

interface Tunnel0
 ip tcp adjust-mss 1360

In web interface: Internet → Other connections → Tunnel → “Limit MSS”.

2) Site-to-Site VPN is up, but traffic doesn’t pass

Symptoms: tunnel is “UP”, but no ping/SMB between subnets. Causes: routes, NAT, IPsec selectors, firewall.

Example (MikroTik, IPsec S2S):

/ip ipsec policy add src-address=192.168.1.0/24 dst-address=192.168.2.0/24 \
  sa-dst-address=203.0.113.2 tunnel=yes action=encrypt
/ip route add dst-address=192.168.2.0/24 gateway=ipsec
/ip firewall nat add chain=srcnat action=accept src-address=192.168.1.0/24 dst-address=192.168.2.0/24

Example (Keenetic, OpenVPN server):

vpn-server openvpn
 direct-access enable
 pool 10.8.0.0/24
 route 192.168.1.0/24

3) NAT breaks VPN/EoIP

Symptoms: tunnel goes up, but no communication between networks. Solution: exclude inter-subnet traffic from masquerade.

/ip firewall nat add chain=srcnat action=accept src-address=192.168.1.0/24 dst-address=192.168.2.0/24 place-before=<id-masq>

4) MTU/MSS: how to choose correctly

Algorithm:

1. Find Path MTU (ping df=yes).
2. Set tunnel MTU lower by overhead.
3. Enable MSS clamp.

/ping <peer-wan-ip> size=1472 df=yes
/ping <peer-lan-ip> interface=eoip-tun size=1450 df=yes
/ip firewall mangle add chain=forward action=change-mss new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn

5) Policy Routing (RouterOS 7)

Symptoms: traffic ignores required rules. Example:

/routing table add name=to-vpn fib
/ip route add dst-address=0.0.0.0/0 gateway=10.8.0.1 routing-table=to-vpn
/routing rule add action=lookup-only-in-table table=to-vpn src-address=192.168.1.0/24

6) SMB from another subnet doesn’t work

Causes: NAT/Firewall, NetBIOS broadcast doesn’t route, DNS. Solution: allow TCP/445, TCP/139, UDP/137-138, disable NAT between subnets.

/ip firewall filter add chain=forward action=accept protocol=tcp dst-port=445 src-address=192.168.1.0/24 dst-address=192.168.2.0/24
/ip firewall nat add chain=srcnat action=accept src-address=192.168.1.0/24 dst-address=192.168.2.0/24

✅ Quick diagnostics checklist

1. L3 connectivity: ping WAN↔WAN, LAN↔LAN.
2. MTU/MSS: ping df=yes, MSS clamp.
3. Routes: ip route print, traceroute.
4. NAT: exceptions before masquerade.
5. Firewall: allow rules, counters.
6. Tunnel: SA/peers (IPsec), client (OVPN).
7. CPU/load: torch, monitor-traffic.
8. Services: telnet host 445.
9. DNS/WINS: name resolution.
10. Logs/pcap: tool sniffer.

📜 Command cheat sheet

MikroTik:

/ping <ip> size=1472 df=yes
/ip firewall mangle add chain=forward action=change-mss new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
/ip firewall nat add chain=srcnat action=accept src-address=<LAN-A>/24 dst-address=<LAN-B>/24 place-before=<id-masq>
/routing table add name=to-vpn fib
/ip ipsec active-peers print
/tool torch <iface>
/tool sniffer quick interface=<iface> file-name=trace.pcap

Keenetic:

show interface Tunnel0
show ip route
show ip nat translations
interface Tunnel0
 ip tcp adjust-mss 1360

📊 Typical MTUs for tunnels

🔀 NAT/Firewall exceptions matrix

⚠ Common pitfalls

• MTU “1500 everywhere” → fragmentation.
• Masquerade “ate” inter-subnet traffic → need exceptions.
• Policy routing without DNS consideration.
• Relying on NetBIOS broadcast.
• Testing only ping → also test TCP/SMB with large files.