I have two mikrotik routers to use in order to connect two locations :

  1. Office 1 - Static IP with a NAT to the ISP, a mikrotik Router can be the DMZ.
  2. Office 2 - Dynamic IP with a NAT to the ISP.

Is it possible to connect the two so boxes behind both of the mikrotiks will be in the same LAN (ARPing each other)? How would you go about doing this? What is the recommended protocol to use?


Since you don't have any static IPs on both sites then you will need to use Dynamic DNS to be able to have both mikrotik routers 'find' each other.

Mikrotik supports its own Dynamic DNS out of the box (it's not easy to remember, but it does the job and works out of the box). Check IP > Cloud to enable it.

Now, on Office 1 since it can be DMZ will be the VPN server. Mikrotik supports PPTP, L2TP, OpenVPN, SSTP. Use which-ever works better for you.

On Office 2 which will be the 'client' side of the VPN you create a vpn client interface connecting to Office's 1 dynamic DNS.

Make sure to use the latest version of Mikrotik so the above features are fully supported.

The next step, now that you have a vpn connection, is to create an EoIP tunnel over the VPN you created. This will allow you to have both sites talk to each other as if they where on the same physical location.

Finally you bridge the EoIP tunnel interface on both sites with your LAN interface(s) and you should be able to talk from one site to another with full ethernet frames.

Now, beware that this approach has a lot of overhead due to double encapsulation of packets.

Another approach would be to enable DMZ on Office 2 as well, and have both Mikrotik routers use only an EoIP tunnel that will connect directly without any VPN under it.
In this case you will need some scripting that will detect your public IP on both sites and update the EoIP interface when the IPs change.

Personally I use the second solution to reduce the overhead as much as possible. For security I use IPsec (since EoIP does not encrypt anything on its own). Be careful about IPsec since it uses a lot of CPU (I wouldn't recommend it on a MIPSBE routerboard).

  • Thanks! 3 questions: 1. I said that I have a static IP in the first office, does it mean I won't need the ddns? 2. All of the protocol you mentioned will work through a NAT (PPTP, L2TP etc..)? 3. If I only need to connect one box from one location to the other, will this overhead still be a problem? Jul 20 '15 at 11:40
  • Oops, sorry I didn't notice the static IP. 1)Yes you don't need ddns in that case! 2)Yes they should work just fine behind NAT. 3) I guess it depends on how much bandwidth and latency your gateways have and the type of traffic that you need to passthrough.
    – Cha0s
    Jul 20 '15 at 13:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.