MikroTik + Keenetic: FAQ and Step-by-Step Diagnostics

This article is compiled as a “cheat sheet” for SOHO/SMB networks: common problems, their symptoms, causes, quick fixes and diagnostic checklists. Suitable for both engineers and admins who maintain the MikroTik ↔ Keenetic pair.

Since 2025 in Russia routers of this platform are produced under the Netcraze brand (OOO “Netcraze”, formerly OOO “Kinetic”), models NC-xxxx; the firmware is the same — NDMS, so everything described also applies to them.

Keenetic features — VPN servers, VPN clients and routing policies — are covered in the “Keenetic” series: VPN server and VPN client.

📑 Navigation

• EoIP “freezes” when transferring large files
• Site-to-Site VPN is up, but traffic doesn’t pass
• NAT breaks VPN/EoIP
• MTU/MSS: how to choose correctly
• Policy Routing (RouterOS 7)
• SMB from another subnet doesn’t work
• Quick diagnostic checklist
• Command cheat-sheets
• Typical MTU for tunnels
• NAT/Firewall exceptions matrix
• Common pitfalls
• Visualizations
• Resources and documentation

1) EoIP “freezes” when transferring large files

Symptoms: SMB/FTP hangs, speed “chops”, RDP disconnects.
Causes: incorrect MTU/MSS, fast-path with IPsec, NAT/Firewall mistakes.

⚡ Quick fix (MikroTik):

/interface eoip add name=eoip-tun remote-address=203.0.113.1 tunnel-id=10 mtu=1458 clamp-tcp-mss=yes
/ip firewall mangle add chain=forward action=change-mss new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
# only if EoIP is encrypted via IPsec (ipsec-secret parameter):
/interface eoip set eoip-tun allow-fast-path=no

EoIP adds at least 42 bytes of headers (8 bytes GRE, 14 bytes Ethernet, 20 bytes IP), so with an MTU of 1500 on the link the tunnel can use 1458. The allow-fast-path parameter belongs to the EoIP interface itself, not to Ethernet ports; according to the documentation it should be disabled if the tunnel goes through IPsec.

Keenetic (CLI):

interface Tunnel0
 ip tcp adjust-mss 1360

In the web interface: Internet → Other connections → Tunnel → “Limit MSS”.

2) Site-to-Site VPN is up, but traffic doesn’t pass

Symptoms: tunnel is “UP”, but there’s no ping/SMB between subnets.
Causes: routes, NAT, IPsec selectors, firewall.

Example (MikroTik, IPsec S2S):

/ip ipsec policy add src-address=192.168.1.0/24 dst-address=192.168.2.0/24 \
  sa-dst-address=203.0.113.2 tunnel=yes action=encrypt
/ip firewall nat add chain=srcnat action=accept src-address=192.168.1.0/24 dst-address=192.168.2.0/24

A route to the remote subnet is not required for such a tunnel: traffic hits IPsec by matching the policy (src-address/dst-address), not by the routing table. The main thing is to ensure masquerade does not change the address first — for that the accept rule in srcnat must be placed above it.

Keenetic as an OpenVPN server: the server is configured by uploading the OpenVPN configuration file in the “Other connections” section; the route to the MikroTik network is specified by route / push "route …" directives in that file. See the article “Keenetic: VPN server for remote access” for details.

3) NAT breaks VPN/EoIP

Symptoms: tunnel comes up, but there is no connectivity between networks.
Solution: exclude inter-subnet traffic from masquerade.

/ip firewall nat add chain=srcnat action=accept src-address=192.168.1.0/24 dst-address=192.168.2.0/24 place-before=<id-masq>

4) MTU/MSS: how to choose correctly

Algorithm:

1. Find the Path MTU (ping df=yes).
2. Set the tunnel MTU lower by the overhead.
3. Enable MSS clamp.

/ping <peer-wan-ip> size=1472 df=yes
/ping <peer-lan-ip> interface=eoip-tun size=1450 df=yes
/ip firewall mangle add chain=forward action=change-mss new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn

5) Policy Routing (RouterOS 7)

Symptoms: traffic ignores the required rules.
Example:

/routing table add name=to-vpn fib
/ip route add dst-address=0.0.0.0/0 gateway=10.8.0.1 routing-table=to-vpn
/routing rule add action=lookup-only-in-table table=to-vpn src-address=192.168.1.0/24

6) SMB from another subnet doesn’t work

Causes: NAT/Firewall, NetBIOS broadcast is not routed, DNS.
Solution: allow TCP/445, TCP/139, UDP/137-138, disable NAT between subnets.

/ip firewall filter add chain=forward action=accept protocol=tcp dst-port=445 src-address=192.168.1.0/24 dst-address=192.168.2.0/24
/ip firewall nat add chain=srcnat action=accept src-address=192.168.1.0/24 dst-address=192.168.2.0/24

✅ Quick diagnostic checklist

1. L3 connectivity: ping WAN↔WAN, LAN↔LAN.
2. MTU/MSS: ping df=yes, MSS clamp.
3. Routes: ip route print, traceroute.
4. NAT: exceptions before masquerade.
5. Firewall: allow rules, counters.
6. Tunnel: SA/peers (IPsec), client (OVPN).
7. CPU/load: torch, monitor-traffic.
8. Services: telnet host 445.
9. DNS/WINS: name resolution.
10. Logs/pcap: tool sniffer.

📜 Command cheat-sheets

MikroTik:

/ping <ip> size=1472 df=yes
/ip firewall mangle add chain=forward action=change-mss new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
/ip firewall nat add chain=srcnat action=accept src-address=<LAN-A>/24 dst-address=<LAN-B>/24 place-before=<id-masq>
/routing table add name=to-vpn fib
/ip ipsec active-peers print
/tool torch <iface>
/tool sniffer quick interface=<iface> file-name=trace.pcap

Keenetic:

show interface Tunnel0
show ip route
show ip nat translations
interface Tunnel0
 ip tcp adjust-mss 1360

📊 Typical MTU for tunnels

Values are a guideline for a link with MTU 1500; find the exact value for your link with ping df=yes (see section 4).

🔀 NAT/Firewall exceptions matrix

⚠ Common pitfalls

• MTU “1500 everywhere” → fragmentation.
• Masquerade “ate” inter-subnet traffic → need exceptions.
• Policy routing without considering DNS.
• Relying on NetBIOS broadcast.
• Testing only with ping → test TCP/SMB with large files.