EoIP, Ethernet over IP, is MikroTik's proprietary tunnel protocol that extends a Layer 2 Ethernet segment across an IP network. For ISPs with distributed access points, remote PoPs, or wireless backhaul links that need to carry multiple VLANs to a central aggregation point, EoIP provides a straightforward way to treat a geographically distributed network as a single Layer 2 domain at the aggregation layer.

The practical use cases in Pakistani ISP networks are consistent: a WISP with multiple tower sites that need to deliver subscriber traffic back to a central aggregation router without investing in full Layer 3 routing at each tower, or an FTTH operator with multiple cabinet locations that need management VLAN connectivity back to the NOC.

When EoIP Is the Right Choice

EoIP is appropriate when: the remote site is a simple access point that does not need its own routing policy, the link between sites is already an IP path (wireless backhaul, leased circuit, or internet link), you want to manage the remote access devices from the central aggregation layer without per-site IP routing configuration, and the traffic volume is moderate enough that the GRE encapsulation overhead is manageable.

EoIP is not the right choice when: you need the remote site to make independent routing decisions, the link is lossy and needs TCP congestion control (GRE has no congestion control), or you need encryption without adding IPsec on top (EoIP is unencrypted by default). For encrypted point-to-point links with Layer 3 routing, SSTP or L2TP with IPsec is more appropriate than EoIP.

Basic EoIP Configuration

EoIP tunnels are configured in pairs: one end at the aggregation router and one end at the remote site router, with a unique tunnel ID matching both ends.

At the aggregation router:

/interface eoip
add name=eoip-site1 remote-address=<site1-router-ip> tunnel-id=1 \
    comment="EoIP to Site 1 - Tower A"

At the remote site router:

/interface eoip
add name=eoip-to-hub remote-address=<aggregation-router-ip> tunnel-id=1 \
    comment="EoIP to hub aggregation"

Add both the EoIP interface and the local subscriber-facing interfaces to a bridge on the remote site router to extend the Layer 2 domain:

/interface bridge
add name=bridge-subscriber

/interface bridge port
add bridge=bridge-subscriber interface=eoip-to-hub
add bridge=bridge-subscriber interface=<local-subscriber-interface>

At the aggregation end, add the EoIP interface to the aggregation bridge alongside other site connections:

/interface bridge port
add bridge=bridge-aggregation interface=eoip-site1

MTU Considerations

EoIP adds a GRE header (4 bytes) and an IP header (20 bytes) to each frame. If your underlying transport path has an MTU of 1500 bytes, EoIP can only carry frames up to 1476 bytes without fragmentation. VLAN-tagged frames add another 4 bytes, reducing the effective payload MTU further.

Set the EoIP interface MTU to account for encapsulation overhead:

/interface eoip
set eoip-site1 mtu=1480

Also set the bridge MTU to match:

/interface bridge
set bridge-aggregation mtu=1480

Verify end-to-end that PMTU discovery is working correctly or set MSS clamping on the tunnel interface to prevent fragmentation issues with subscriber TCP traffic.

Redundancy with Multiple EoIP Tunnels

For remote sites where the backhaul has redundant paths, create two EoIP tunnels over different paths and add both to the bridge with RSTP (Rapid Spanning Tree Protocol) to prevent loops while providing failover:

/interface bridge
set bridge-aggregation protocol-mode=rstp

/interface bridge port
add bridge=bridge-aggregation interface=eoip-site1-primary priority=64
add bridge=bridge-aggregation interface=eoip-site1-secondary priority=128

RSTP will block the secondary port under normal operation and activate it within seconds if the primary tunnel fails. The lower bridge port priority makes the primary port preferred as the designated port.

Monitoring EoIP Tunnel Health

Monitor EoIP tunnel state through SNMP polling of the tunnel interface status, or with RouterOS scripting that checks the tunnel interface running state and triggers an alert if it goes down:

:foreach i in=[/interface eoip find] do={
    :local name [/interface eoip get $i name]
    :local running [/interface eoip get $i running]
    :if (!$running) do={
        :log warning ("EoIP tunnel DOWN: " . $name)
        # Add alerting action here
    }
}

Schedule this script to run every minute for timely detection of tunnel failures. For operators who want tunnel status integrated into their NOC monitoring dashboard with alert routing through your escalation chain, NOC Enablement & Monitoring covers the monitoring integration. For operators designing multi-site networks where EoIP is one component of a broader topology, Network Design & Optimization covers the full site interconnect design.