EOIP(8)

NAME
eoip - manage MikroTik compatible EoIP and EoIPv6 tunnel interfaces

SYNOPSIS
eoip add [name if-name] tunnel-id id [local src-address] remote dst-address [ttl ttl] [tos tos] [link ifindex|ifname] [keepalive secs[,retries] | keepalive none]
eoip change name if-name tunnel-id id [...]
eoip list
eoip version

DESCRIPTION
eoip creates, changes and lists EoIP (Ethernet over IP) tunnel interfaces. EoIP is a MikroTik RouterOS compatible protocol that carries whole Ethernet frames over an IPv4 or IPv6 transport network, presenting a transparent layer 2 link between the two endpoints.

The tunnel kind is selected automatically from the address family of the local and remote addresses: IPv4 addresses create an eoip interface (IP protocol 47), IPv6 addresses create an eoipv6 interface (IP protocol 97). The kernel modules from the eoip-dkms package must be loaded.

Both ends of a tunnel must be configured symmetrically: the local address of one end must equal the remote address of the other, and the tunnel-id must match.

COMMANDS

add Create a new tunnel interface. The kernel assigns an eoipN name when name is omitted.

change
    Change an existing tunnel interface, selected by name.

list
    List all eoip and eoipv6 tunnel interfaces.

version
    Print the version and exit.

OPTIONS

tunnel-id id
    Tunnel identifier. Mandatory. 0 to 65535 for eoip, 0 to 4095 for eoipv6. Must match on both ends.

name if-name
    Interface name. Mandatory for change.

local src-address
    Local transport address. Its family selects eoip or eoipv6.

remote dst-address
    Remote transport address.

ttl ttl
    Outer hop limit (0 = use the path default).

tos tos
    Outer type of service / traffic class.

link ifindex|ifname
    Bind the tunnel to a specific underlying device.

keepalive secs[,retries] | keepalive none
    Configure keepalive. Off by default. A bare secs implies the RouterOS default of 10 retries; retries of 0 selects send-only mode (transmit keepalives but never drop the carrier). When monitoring is enabled the interface carrier is dropped after secs * retries of silence and restored on the first received keepalive. When the option is omitted, change leaves the current keepalive configuration untouched.

EXAMPLES
Create an IPv4 tunnel to a MikroTik at 198.51.100.11 with tunnel id 1234:

    eoip add name eoip1234 local 203.0.113.50 remote 198.51.100.11 tunnel-id 1234
    ip link set eoip1234 up

Create an IPv6 tunnel and enable RouterOS default keepalive:

    eoip add name eo6 local 2001:db8::1 remote 2001:db8::2 tunnel-id 42 keepalive 10,10

NOTES
On the MikroTik side, either enable keepalive to match or configure the tunnel with !keepalive.

Hosts with a stateful firewall may silently drop all incoming EoIP packets. EoIP uses GRE version 1 with the non-standard protocol type 0x6400; the kernel GRE connection tracker (CONFIG_NF_CT_PROTO_GRE, enabled on all common distributions) parses GRE version 1 only in its PPTP form, so every EoIP packet fails tuple extraction and is classified INVALID. Rulesets that drop invalid packets early (for example firewalld's built-in ct state invalid drop rule) discard the tunnel traffic before any GRE accept rule is consulted: tcpdump still shows the packets, the interface RX counters stay at zero and a keepalive monitored tunnel never raises its carrier. Exempt GRE from connection tracking and accept it:

    nft -f - <<'EOF'
    table inet eoip_notrack {
        chain pre {
            type filter hook prerouting priority raw; policy accept;
            ip protocol 47 notrack
        }
        chain out {
            type filter hook output priority raw; policy accept;
            ip protocol 47 notrack
        }
    }
    EOF
    firewall-cmd --add-protocol=gre --permanent   # firewalld hosts

The accept rule is still needed because untracked packets never match an established/related shortcut. The same classification affects EoIP transit through a Linux router that drops invalid packets in its forward path. EoIPv6 (IP protocol 97) is handled by the generic connection tracker and is not affected; it only needs a plain accept for protocol 97.

EoIP provides no transport security; use it over trusted network or over some other encrypted transport.

IPsec support is not yet implemented in these modules.

SEE ALSO
ip(8), ip-link(8)

AUTHOR
Boian Bonev <bbonev@ipacct.com>