Page cover

Mikrotik Use Cases - PPPoE, ECMP, Failover, Recursive Routing and WireGuard

Mikrotik's RouterOS is a very versatile platform for all sorts of possible network setup scenarios in both carrier and enterprise environments. As long as the appropriate Mikrotik harward devices are used in the design, the capability of its platform is unlimited unlike other networking giants. It is even getting better with the latest and greatest version of its RouterOS 7.*. Although the syntax can be a bit painful to adapt for the Mikrotik CLI veterans, it is still worth it to get the latest features like WireGuard, ZeroTier, etc., on the receiving end. For instance, most of the new Mikrotik platforms lately come with ARM 32 and 64 bit CPU architecture to have more advanced features like containerisation in the box. It is quite ambitious to implement all the bleeding edge features in the RouterOS but I quite appreciate their adventurous spirit of "can do" attitude towards the very old fashioned industry of networking.

In this article, I have been setting up a GNS3 lab to experiment its RouterOS 7.7 features as well as an attempt to keep my rusty networking skills to be refreshed. There are a few use cases I have been wanting to test on this lab as listed below.

  • PPPoE server and client configuration

  • ECMP configuration for multi-WAN connections

  • Failover WAN

  • Recursive routing in simple setup

  • WireGuard setup for site-to-site VPN

Prerequisites

  • GNS3 Emulator

  • Mikrotik CHR appliance setup on GNS3

  • Mikrotik RouterOS version 7.7

  • Basic level of comfortableness with Mikrotik RouterOS CLI and GNS3 setup

  • Basic understanding of VPN tunneling and WireGuard in general

Network Topology

Mikrotik Use Cases - PPPoE, ECMP, Recursive Routing and WireGuard

  • One core router "core" to simulate the internet backbone/core connected to NAT1 for the internet breakout connection.

  • Two ISP routers "isp1" and "isp2" to simulate the ISP's PPPoE servers on the providers' end.

  • Three customer routers "mtr1", "mtr2" and "mtr3" to simulate the enterprise customers' end. "mtr2" is especially used for ECMP and Recursive Routing since it is connected to both "isp1" and "isp2" routers.

  • Behind each mtr router, it has various LAN subnets for PCs.

Configuration

Core router config

Here is the full configuration and its description of "core" router

ISP routers config

Both isp1 and isp2 routers config and its description can be found in the below code snippets.

Here is how I configure the isp1 router.

Here is how I configure the isp2 router.

Customer routers config

Note that both mtr1 and mtr3 configs are very similar but mtr2 is configured quite differently since it is connected to both isp1 and isp2 routers for upstream internet connection.

Here is the full mtr1 router configuration wtih PPPoE Client and WireGuard site-to-site VPN setup.

A couple of facts about mtr1 router setup - it uses the PPPoE accounts isp1user1 created on isp1 router and it has been assumed to have a dynamic IP address assigned by its ISP so it has to initiate the WireGuard VPN connection to the other end mtr3 which has a static IP address assigned by its ISP. Note that the allowed-address is used to allow the WireGuard interface IP and LAN IP range on the other side of its tunnel. The endpoint-address is for the public IP address of mtr3.

Here is the full mtr2 router configuration wtih ECMP for multi-home PPPoE connections.

Instead of ECMP, mtr2 can be also configured as failover WAN connection between two PPPoE connections as below.

For recursive routing, ensure that mtr2 is pingable to Google 8.8.8.8 and Cloudflare 1.1.1.1 first then start configuring the routes as below.

The recursive routing is very useful when both of its immediate links to upstream from mtr2 are up but the reachability to the internet is broken due to disconnect or malfunction at the links between core and isp routers. Note that check-gateway parameter is set to ping for the first two routes for ping reachability check on each link.

Here is how I configure mtr3 for its PPPoE client configuration and site-to-site WireGuard VPN conection.

With the configs on both mtr1 and mtr3, LAN from each side should have the connectivity to the other side via WireGuard site-to-site VPN tunnel.

PreviousMikrotik QinQ VLAN trunking and policy based routingNextMikrotik RouterOS Hardening for your home internet connection

Last updated

Was this helpful?