MikroTik

OpenVPN is a reliable and time-tested VPN protocol that allows organizing secure remote access to a local network. MikroTik RouterOS supports OpenVPN in server mode starting from version 6.x (TCP), and from version 7+ — also UDP, but with a number of architectural limitations:

• mandatory authentication by username/password even when using certificates;
• limited list of ciphers and algorithms;
• absence of some features of “classic” OpenVPN.

Despite this, OpenVPN on MikroTik remains a popular solution — especially in scenarios where clients do not support WireGuard or compatibility with legacy systems is required.

Mikrotik routers are rightly valued by system administrators for their incredible flexibility.
A unique feature of this hardware is that a budget home hAP lite and a powerful enterprise router costing thousands of dollars run the same operating system — RouterOS.

That means once you learn to configure one device, you can manage any equipment from the brand.
In this article we’ll go over the fundamental steps to set up a Mikrotik from scratch to a fully working state.

In today’s world of networking technologies, combining two remote offices into a single entity is a fairly routine task. Usually, L3 tunnels are used for this (for example, IPIP or IPsec). However, there are situations when simple routing is not enough and full L2 connectivity is required, as if remote devices were connected to the same switch.

Let’s figure out when this is necessary and how to configure such connectivity correctly so that it is not only working but also fault-tolerant.

The EoIP (Ethernet over IP) protocol from MikroTik is used to create an L2 tunnel over an IP network, allowing you to combine two remote local networks into a single broadcast domain.
If your EoIP tunnel does not establish (no “R” — Running flag), follow this step-by-step checklist.

1. Check IP connectivity (L3)

Before starting, make sure the routers see each other at the IP level.

Ping the remote side:

This article is compiled as a “cheat sheet” for SOHO/SMB networks: common issues, their symptoms, causes, quick fixes, and diagnostic checklists. Suitable for both engineers and admins who maintain the MikroTik ↔ Keenetic bundle.

📑 Navigation

• EoIP “freezes” when transferring large files
• Site-to-Site VPN is up, but traffic doesn’t pass
• NAT breaks VPN/EoIP
• MTU/MSS: how to choose correctly
• Policy Routing (RouterOS 7)
• SMB from another subnet doesn’t work
• Quick diagnostics checklist
• Command cheat sheet
• Typical MTUs for tunnels
• NAT/Firewall exceptions matrix
• Common pitfalls
• Visualizations
• Resources and documentation

1) EoIP “freezes” when transferring large files

Symptoms: SMB/FTP hangs, speed fluctuates, RDP drops. Causes: incorrect MTU/MSS, fast-path with IPsec, NAT/Firewall errors.

Many thanks to Mikhail for the work, I am very pleased with the result. I especially thank him for the recommendations during the setup process — from my rather muddled brief (and I know little about servers) Mikhail, with clarifying questions and suggestions of his own, formulated a clear understanding of what tasks the final build will solve and how to organize everything in the best way. I recommend!

Reply: Thank you for the feedback!
Glad to help!

In the world of networking, there’s often a need to bridge two remote LANs so they behave like a single local network—even when separated by different routers. For MikroTik users, the concept of EoIP (Ethernet over IP) is familiar: it’s a proprietary tunneling protocol that allows creation of a virtual Ethernet interface (Layer 2) over an IP network.

Good news for Keenetic users: since firmware NDMS v2.10, Keenetic routers also support EoIP! This opens up exciting possibilities for advanced network designs.

In a world where cyberattacks are becoming increasingly sophisticated, protecting remote access to servers and network equipment is of paramount importance. Simply opening ports for SSH, RDP, or web interfaces makes them targets for constant scanning and brute-force attacks.

Today, we’ll explore a powerful yet lesser-known technique that significantly improves the security of your MikroTik (and not only): Port Knocking. It’s not just about “closing ports,” but a smart system that makes your services invisible to most scanners and bots.

Introduction: Mikrotik – More Than Just a Router

When it comes to networking hardware for home or small offices, most people think of consumer-grade routers like those from TP-Link, ASUS, or D-Link. However, there’s a category of devices offering far more flexibility, features, and control—while remaining affordable. We’re talking about Mikrotik, a Latvian company known for its wide range of networking gear, especially routers and switches.

What truly sets Mikrotik apart isn’t just the hardware, but its operating system — RouterOS. This powerful software transforms ordinary devices into versatile tools capable of handling tasks usually reserved for far more expensive enterprise solutions.

In today’s digital world, where every megabyte counts and stable connectivity is gold, a single internet channel is often just not enough. Maybe you have several external IP addresses gathering dust, or your hosting provider suddenly introduced those “unpleasant” traffic limits, threatening your budget and peace of mind. But don’t panic! PCC (Per Connection Classifier) on your MikroTik router running the updated RouterOS 7.x is your ticket to a world without limits. It allows you to optimize costs and bypass annoying restrictions.