MikroTik EoIP & VPLS Tunnels: Layer 2 VPN Over the Internet

Most VPNs operate at Layer 3 – they route packets between two IP subnets. But sometimes you need Layer 2 connectivity: the same broadcast domain, the same VLAN, the same subnet on both sides of the internet. That's what EoIP (Ethernet over IP) and VPLS (Virtual Private LAN Service) do on MikroTik.

Use cases include: extending a VLAN between two offices, bridging remote access points to a central controller, connecting legacy devices that rely on broadcast traffic, or building an ISP backbone that carries customer VLANs across a WAN.

EoIP vs. VPLS – Which Do You Need?

Rule of thumb: Use EoIP for simple 2-site bridges. Use VPLS when you have 3 or more sites that need to share a broadcast domain.

Prerequisites

• Two or more MikroTik routers with public IPs (or reachable via VPN).
• RouterOS v6 or v7.
• WinBox or SSH access to all routers.
• Understanding of bridging and VLANs (see our VLAN guide).

Part 1: EoIP Tunnel (Point-to-Point Layer 2)

Network Topology

• Site A: WAN IP 203.0.113.10, LAN 192.168.1.0/24
• Site B: WAN IP 198.51.100.20, LAN 192.168.1.0/24 (same subnet!)
• Goal: Both sites share the same 192.168.1.0/24 as if on the same switch.

Step 1: Create EoIP Tunnel on Both Routers

Site A:

/interface eoip add name=eoip-tunnel remote-address=198.51.100.20 tunnel-id=100 comment="EoIP to Site B"

Site B:

/interface eoip add name=eoip-tunnel remote-address=203.0.113.10 tunnel-id=100 comment="EoIP to Site A"

WinBox: Interfaces → EoIP Tunnel → Add New.

Critical: The tunnel-id must match on both sides. It's a unique identifier – if you have multiple EoIP tunnels between the same routers, each needs a different ID.

Step 2: Bridge the EoIP Tunnel with Local LAN

To make remote devices appear on the same LAN, add both the EoIP interface and the local LAN port to the same bridge.

Both routers:

/interface bridge add name=bridge-l2vpn
/interface bridge port add interface=ether2 bridge=bridge-l2vpn
/interface bridge port add interface=eoip-tunnel bridge=bridge-l2vpn

Now a device on Site A's ether2 and a device on Site B's ether2 are on the same Layer 2 network. They can get DHCP from the same server, see each other's broadcasts, and communicate as if directly connected.

Step 3: Assign IP to the Bridge (Optional)

# On Site A:
/ip address add address=192.168.1.1/24 interface=bridge-l2vpn

# On Site B:
/ip address add address=192.168.1.2/24 interface=bridge-l2vpn

Step 4: Firewall – Allow EoIP (GRE Protocol 47)

/ip firewall filter add chain=input protocol=gre action=accept comment="Allow EoIP/GRE"

Place this before your drop rule.

Step 5: Add IPsec Encryption (Recommended)

EoIP transmits in cleartext by default. Wrap it in IPsec for security:

/interface eoip set eoip-tunnel ipsec-secret="YourStrongPSK2026"

Do this on both routers with the same secret. RouterOS will automatically create the IPsec peer, policy, and SA. Also allow IPsec in the firewall:

/ip firewall filter add chain=input protocol=udp dst-port=500 action=accept comment="IKE for EoIP"
/ip firewall filter add chain=input protocol=udp dst-port=4500 action=accept comment="NAT-T for EoIP"
/ip firewall filter add chain=input protocol=ipsec-esp action=accept comment="ESP for EoIP"

Step 6: Test EoIP

# Check tunnel status
/interface eoip print

# Ping from Site A to Site B's bridge IP
/ping 192.168.1.2

# Check bridge forwarding table
/interface bridge host print where bridge=bridge-l2vpn

You should see MAC addresses from the remote site in the bridge host table.

Part 2: VPLS (Multi-Point Layer 2 VPN)

VPLS creates a virtual Ethernet switch spanning multiple routers. Unlike EoIP (which is point-to-point), VPLS allows any number of sites to share the same broadcast domain without creating a full mesh of tunnels.

Topology Example

• Router A (HQ): 203.0.113.10, loopback 10.255.255.1
• Router B (Branch 1): 198.51.100.20, loopback 10.255.255.2
• Router C (Branch 2): 192.0.2.30, loopback 10.255.255.3
• All three should share VLAN 100 as a single broadcast domain.

Step 1: Configure Loopback Addresses and Routing

VPLS uses loopback IPs for LDP (Label Distribution Protocol) sessions. Ensure all routers can reach each other's loopbacks via OSPF, static routes, or any routing protocol.

# On Router A:
/interface bridge add name=loopback
/ip address add address=10.255.255.1/32 interface=loopback

# On Router B:
/interface bridge add name=loopback
/ip address add address=10.255.255.2/32 interface=loopback

# On Router C:
/interface bridge add name=loopback
/ip address add address=10.255.255.3/32 interface=loopback

Ensure OSPF or static routes advertise these loopbacks so all routers can reach each other. See our OSPF guide for dynamic routing setup.

Step 2: Enable LDP (Label Distribution Protocol)

# On all routers:
/mpls ldp set enabled=yes lsr-id=10.255.255.X transport-address=10.255.255.X
/mpls ldp interface add interface=ether1

Replace X with each router's loopback suffix (1, 2, or 3).

Step 3: Create VPLS Tunnel

# On Router A (connect to B and C):
/interface vpls add name=vpls-to-B remote-peer=10.255.255.2 vpls-id=100:0 comment="VPLS to Branch1"
/interface vpls add name=vpls-to-C remote-peer=10.255.255.3 vpls-id=100:0 comment="VPLS to Branch2"

# On Router B (connect to A and C):
/interface vpls add name=vpls-to-A remote-peer=10.255.255.1 vpls-id=100:0
/interface vpls add name=vpls-to-C remote-peer=10.255.255.3 vpls-id=100:0

# On Router C (connect to A and B):
/interface vpls add name=vpls-to-A remote-peer=10.255.255.1 vpls-id=100:0
/interface vpls add name=vpls-to-B remote-peer=10.255.255.2 vpls-id=100:0

Critical: The vpls-id must be identical on all routers for the same VPLS instance.

Step 4: Bridge VPLS Interfaces with Local Ports

# On all routers:
/interface bridge add name=bridge-vpls
/interface bridge port add interface=ether3 bridge=bridge-vpls
/interface bridge port add interface=vpls-to-A bridge=bridge-vpls  # (adjust names per router)
/interface bridge port add interface=vpls-to-B bridge=bridge-vpls
# etc.

Step 5: Set Bridge Horizon (Loop Prevention)

VPLS uses split horizon to prevent loops: traffic received from one VPLS peer should never be forwarded to another VPLS peer. Set horizon=1 on all VPLS ports:

/interface bridge port set [find interface~"vpls"] horizon=1

Local ports (ether3) should have horizon=none (default). This ensures that a broadcast from Branch 1 goes to HQ and Branch 2 directly, but HQ won't re-broadcast it back to Branch 1.

MTU Considerations

Both EoIP and VPLS add overhead to each frame:

• EoIP: ~42 bytes overhead (GRE header + IP header).
• VPLS: ~40+ bytes overhead (MPLS labels + Ethernet).
• IPsec: Adds another ~50-80 bytes.

If your WAN path has a standard 1500-byte MTU, the effective payload inside the tunnel is only ~1400-1460 bytes. Set the bridge or tunnel MTU accordingly:

/interface eoip set eoip-tunnel mtu=1400
# or for the bridge:
/interface bridge set bridge-l2vpn mtu=1400

Alternatively, enable clamp-tcp-mss in the bridge to automatically adjust TCP MSS for tunneled traffic.

When NOT to Use Layer 2 Tunnels

• Large broadcast domains: Extending a /16 subnet across the internet will flood your tunnel with broadcast traffic. Keep L2 VPNs to small subnets (/24 or smaller).
• High latency links: ARP, DHCP, and other broadcast protocols are sensitive to latency. A 200ms intercontinental link will make L2 services feel sluggish.
• Scaling beyond ~20 sites: Full-mesh VPLS becomes unwieldy. Consider VXLAN or a Layer 3 VPN with routing instead.
• When Layer 3 VPN works: If you just need IP connectivity between subnets, use WireGuard or IPsec site-to-site – it's simpler and more efficient.

Troubleshooting

• Tunnel is up but no traffic passes: Check the bridge – is the EoIP/VPLS interface added as a port? Run /interface bridge port print. Also check MTU – if frames are too large, they're silently dropped.
• Bridge loops (broadcast storm): If you bridged multiple VPLS interfaces without setting horizon, you'll get loops. Set horizon=1 on all VPLS/EoIP tunnel ports.
• EoIP tunnel shows "running" but no data: Verify both sides have matching tunnel-id. Also check firewall – GRE (protocol 47) must be allowed on input chain.
• VPLS not establishing: Check LDP sessions: /mpls ldp neighbor print. If empty, the routers can't reach each other's transport addresses. Fix routing first.
• Slow performance: EoIP is CPU-intensive, especially with IPsec. On low-end routers (hEX lite), expect 50-100 Mbps max. Consider hardware with AES acceleration.
• DHCP across tunnel: If using a single DHCP server at one site, clients at the remote site need the broadcast to reach it. This works naturally with L2 bridging, but verify with /ip dhcp-server lease print.

EoIP Complete Script (2 Sites with IPsec)

# === Site A (203.0.113.10) ===
/interface eoip add name=eoip-tunnel remote-address=198.51.100.20 tunnel-id=100 ipsec-secret="StrongL2PSK2026"
/interface bridge add name=bridge-l2
/interface bridge port add interface=ether2 bridge=bridge-l2
/interface bridge port add interface=eoip-tunnel bridge=bridge-l2
/ip address add address=192.168.1.1/24 interface=bridge-l2
/ip firewall filter add chain=input protocol=gre action=accept comment="Allow EoIP"
/ip firewall filter add chain=input protocol=udp dst-port=500 action=accept comment="IKE"
/ip firewall filter add chain=input protocol=udp dst-port=4500 action=accept comment="NAT-T"
/ip firewall filter add chain=input protocol=ipsec-esp action=accept comment="ESP"

# === Site B (198.51.100.20) ===
/interface eoip add name=eoip-tunnel remote-address=203.0.113.10 tunnel-id=100 ipsec-secret="StrongL2PSK2026"
/interface bridge add name=bridge-l2
/interface bridge port add interface=ether2 bridge=bridge-l2
/interface bridge port add interface=eoip-tunnel bridge=bridge-l2
/ip address add address=192.168.1.2/24 interface=bridge-l2
/ip firewall filter add chain=input protocol=gre action=accept comment="Allow EoIP"
/ip firewall filter add chain=input protocol=udp dst-port=500 action=accept comment="IKE"
/ip firewall filter add chain=input protocol=udp dst-port=4500 action=accept comment="NAT-T"
/ip firewall filter add chain=input protocol=ipsec-esp action=accept comment="ESP"

Conclusion

EoIP and VPLS are powerful tools for extending Layer 2 networks across the internet – something most VPN protocols can't do. Use EoIP for simple 2-site bridges, and VPLS when you need multi-point connectivity. Always add IPsec encryption, keep broadcast domains small, and watch your MTU.

For Layer 3 alternatives (which are simpler for most use cases), see our site-to-site WireGuard guide or IPsec tutorial. And for VLAN management on your local network, check our VLAN configuration guide.