Community discussions

MikroTik App
 
m3a2r1
newbie
Topic Author
Posts: 25
Joined: Sat Mar 29, 2014 12:11 pm

Two mikrotiks and EOIP tunnel in bridge

Wed Oct 29, 2014 3:19 pm

I've got such situation:

Router 1:
LAN1 10.1.1.0/24 with dhcp server
public IP
PPTP server
EOIP with router 2: local ip 10.1.1.1 , remote ip 10.1.1.101

Router 2:
LAN2 192.168.2.0/24 with dhcp server
behind NAT
PPTP client to router 1
EOIP with router 1: local ip 10.1.1.101, remote ip 10.1.1.1

Scenario:
both sides of eoip in bridge with local lan (for broadcast traffic)

issues:
PC in LAN1 gets address from LAN2, it works but it's not what I want to get

when I disable eoip in bridge on router1, PC gets address from LAN1 - it's ok
when I enable eoip in bridge again, PC gets address from LAN1 but route is going by 10.1.1.101 - why? My default routing is set to WAN interface.
with enabled eoip in bridge, another PC in LAN1 can't get ip address at all - it declines to get ip

So my questions:
1) How to block dhcp traffic from router 2, I want to use separate dhcp servers and 2 different networks
2) How to check why MT routes traffic from PC in LAN1 to LAN2, if I check traceroute directly from MT, it work correct.
 
User avatar
rmmccann
Member Candidate
Member Candidate
Posts: 182
Joined: Tue Sep 25, 2012 11:15 pm
Location: USA

Re: Two mikrotiks and EOIP tunnel in bridge

Wed Oct 29, 2014 5:29 pm

You'd have to set up some firewall rules to block DHCP and enable IP firewall on your bridge.

The better question might be - why do you want to use EoIP in this instance? If you are looking for a simple VPN, maybe something like PPTP or IPSec would be a better choice? EoIP is for layer 2 communication. If your two subnets need to communicate this can be done with another method and routes.
 
m3a2r1
newbie
Topic Author
Posts: 25
Joined: Sat Mar 29, 2014 12:11 pm

Re: Two mikrotiks and EOIP tunnel in bridge

Wed Oct 29, 2014 5:44 pm

As I wrote, I want broadcast traffic, I want to use LAN Messenger in both (and probably next ones) networks.
 
m3a2r1
newbie
Topic Author
Posts: 25
Joined: Sat Mar 29, 2014 12:11 pm

Re: Two mikrotiks and EOIP tunnel in bridge

Wed Oct 29, 2014 5:56 pm

You'd have to set up some firewall rules to block DHCP and enable IP firewall on your bridge.
But this is not the answer for my question - I would like to know what is wrong that I've got ip assigned by proper dhcp and it's not working good, blocking dhcp traffic will not resolve my problem.
 
User avatar
rmmccann
Member Candidate
Member Candidate
Posts: 182
Joined: Tue Sep 25, 2012 11:15 pm
Location: USA

Re: Two mikrotiks and EOIP tunnel in bridge

Wed Oct 29, 2014 8:00 pm

But this is not the answer for my question - I would like to know what is wrong that I've got ip assigned by proper dhcp and it's not working good, blocking dhcp traffic will not resolve my problem.
Well, for starters you can't have two DHCP servers on the same broadcast domain assigning different subnets and expecting things to work properly. You need to create a firewall filter to block DHCP server from the other end, on both sides - ie on the routers you need to block DHCP server traffic that is coming FROM the EoIP tunnel. You should be able to do this by port. If you don't do this, there is no guarantee that router 1 clients will get an IP in LAN1 - they may get a response and an IP assignment from router 2 via the EoIP tunnel.
 
m3a2r1
newbie
Topic Author
Posts: 25
Joined: Sat Mar 29, 2014 12:11 pm

Re: Two mikrotiks and EOIP tunnel in bridge

Thu Oct 30, 2014 10:47 am

Ok, I've been isolated dhcp traffic in eoip tunnel - both LANs get address from own dhcp but issue with routing still exists. Routing from LAN1 is going by 10.1.1.101 until I disable eoip tunnel in bridge.
 
User avatar
rmmccann
Member Candidate
Member Candidate
Posts: 182
Joined: Tue Sep 25, 2012 11:15 pm
Location: USA

Re: Two mikrotiks and EOIP tunnel in bridge

Thu Oct 30, 2014 3:13 pm

Going by your configuration description, the only other thought I had would be if "Add Default Route" was enabled on the PPTP client which would cause traffic to re-route to the other router, however traffic should flow in the opposite direction you've described in this case.

Can you provide an "/export compact" of your configuration? Be sure to remove any sensitive information like public IP addresses, usernames and passwords, etc.
 
m3a2r1
newbie
Topic Author
Posts: 25
Joined: Sat Mar 29, 2014 12:11 pm

Re: Two mikrotiks and EOIP tunnel in bridge

Thu Oct 30, 2014 6:56 pm

"Add default route" on PPtP client (which is on router2) could cause such situation but in LAN2. I'm still talking about issues in LAN1 where is PPtP server located. So that's not it. (however that options is disabled).
 
User avatar
rmmccann
Member Candidate
Member Candidate
Posts: 182
Joined: Tue Sep 25, 2012 11:15 pm
Location: USA

Re: Two mikrotiks and EOIP tunnel in bridge

Thu Oct 30, 2014 7:48 pm

So just for clarification-

When EoIP tunnel is up and a PC in LAN1 requests an IP address - does it get assigned an IP from router1 and in that assignment, is router1's IP address listed as the default gateway?
 
m3a2r1
newbie
Topic Author
Posts: 25
Joined: Sat Mar 29, 2014 12:11 pm

Re: Two mikrotiks and EOIP tunnel in bridge

Thu Oct 30, 2014 9:29 pm

Yes, exactly. Address and default gateway is provided by own dhcp server.
Only routing trace is changing dynamically (I'm testing windows tracert to 8.8.8.8 ).
When eoip is disabled in bridge, first hop is router private ip 10.1.1.1 , when I enable eoip in bridge, first hop changes to 10.1.1.101 (remote end of eoip tunnel) and routing goes by remote network. But on PC default gateway is still 10.1.1.1, funny, isn't it?
 
User avatar
rmmccann
Member Candidate
Member Candidate
Posts: 182
Joined: Tue Sep 25, 2012 11:15 pm
Location: USA

Re: Two mikrotiks and EOIP tunnel in bridge

Thu Oct 30, 2014 10:18 pm

Very, very strange.

Do you see anything change in the routing table when the EoIP tunnel is up vs when it's down?

There has to be a route taking preference (or becoming active) when the remote end of the tunnel comes online because the MT router in LAN1 is making the decision to forward traffic, not the client.
 
m3a2r1
newbie
Topic Author
Posts: 25
Joined: Sat Mar 29, 2014 12:11 pm

Re: Two mikrotiks and EOIP tunnel in bridge

Thu Oct 30, 2014 11:35 pm

Tunnel is still up, I only disable/enable it in bridge. Nothing changes in routing table, default route for PC in LAN1 is 10.1.1.1.

My default route for MT is WAN interface. So why it can routes any traffic by eoip tunnel (in bridge? It seems not possible but it's true.
 
User avatar
rmmccann
Member Candidate
Member Candidate
Posts: 182
Joined: Tue Sep 25, 2012 11:15 pm
Location: USA

Re: Two mikrotiks and EOIP tunnel in bridge

Thu Oct 30, 2014 11:45 pm

I'm at a loss as to why it's doing it, however you should be able to create some bridge filters to allow your desired traffic/subnets and broadcast traffic, yet block anything destined for the internet. This won't resolve the underlying problem but should stop the internet traffic from flowing over the EoIP tunnel.
 
m3a2r1
newbie
Topic Author
Posts: 25
Joined: Sat Mar 29, 2014 12:11 pm

Re: Two mikrotiks and EOIP tunnel in bridge

Fri Oct 31, 2014 10:57 am

I've noticed today that traceroute from 10.1.1.1 to 10.1.1.41 is going by 10.1.1.101, then returns to 10.1.1.1 .
It is very very strange.
 
User avatar
rmmccann
Member Candidate
Member Candidate
Posts: 182
Joined: Tue Sep 25, 2012 11:15 pm
Location: USA

Re: Two mikrotiks and EOIP tunnel in bridge

Fri Oct 31, 2014 3:18 pm

I would recommend shooting an email over to support@mikrotik.com with a supout from both routers and see if they can spot the problem.

I've noticed with my EoIP tunnels that internet-destined uplink (upload) traffic gets blasted over the tunnel and can saturate it, so I've had to create similar rules to keep traffic to only what I want across the tunnels. I'm on a single subnet with multiple gateways, a single DHCP server and some specific settings to force certain clients to use certain gateways. I don't see the problem you have but I do see other problems from time to time.

I have a suspicion my problem has to do with the fact I'm using VRRP though.
 
m3a2r1
newbie
Topic Author
Posts: 25
Joined: Sat Mar 29, 2014 12:11 pm

Re: Two mikrotiks and EOIP tunnel in bridge

Fri Oct 31, 2014 10:37 pm

I've found what was the reason of problem. On bridge of router 2 was set proxy-arp instead of arp enabled.
 
User avatar
rmmccann
Member Candidate
Member Candidate
Posts: 182
Joined: Tue Sep 25, 2012 11:15 pm
Location: USA

Re: Two mikrotiks and EOIP tunnel in bridge

Mon Nov 03, 2014 5:10 pm

I've found what was the reason of problem. On bridge of router 2 was set proxy-arp instead of arp enabled.
Well that would certainly do it. Very good, glad you got it resolved!

Who is online

Users browsing this forum: No registered users and 33 guests