How to utilize a GRE / IPIP Tunnel with a Mikrotik Router

GRE / IPIP Tunnel for X4B protected services with Mikrotik routers

MikroTik RouterOS is a low cost router operating system which can be installed on either MikroTik proprietary Router Board's or standard x86 hardware. This operating system is based off Linux and features full support for GRE & IP-in-IP tunnels.

This tutorial will guide you through the steps to install a GRE or IP-in-IP tunnel on Mikrotik RouterOS 5.x.

This recipe retains legacy RouterOS 5.x syntax, including routing-mark on /ip route. Check the installed version with /system resource print; newer releases have different policy-routing requirements. Consult the MikroTik routing documentation for your version before adapting the recipe.

Requirements:

• A X4B DDoS Protected Service
• A router with Mikrotik 5.x RouterOS

Notes:

This tutorial is for the configuration of a Singlehomed service, repeat as necessary for a multi-homed service or multiple tunnels.

Steps:

Values beginning with $ are placeholders from the Linux tunnel script, not ready-to-run RouterOS variables. Replace them with your assigned literal addresses before pasting commands. Keep X4B-Tunnel as the interface name throughout creation, address assignment, NAT and routing. If you choose another name, replace every occurrence.

Step 1

Open Services, find your service, and choose Action > Tunnels. Click Add Tunnel, select GRE or IP-in-IP in Tunnel type, enter your router's public IP in Backend address, and click Save to create the tunnel. For this GRE example, locate the saved tunnel, click its Security Key padlock to disable the key, then click Save again. Reload the page and check that the key remains disabled. IP-in-IP does not use a GRE key.

Step 2

Open your service's Ports page. Under Single Port, click Add port manually when Add your first port is shown; otherwise click Add Port. For the example below, enter 80 in Port start, choose TCP in Protocol, and select the available Encapsulated backend method with your tunnel. Click Save. Add other required listeners or ranges separately.

Return to Tunnels and choose Action > Setup Tunnel. Under Linux / BSD, select View Tunnel Script to inspect the variable values used below. These values describe the tunnel; do not run the Linux script on RouterOS.

Step 3

Create one interface in MikroTik RouterOS. Choose either IPIP or GRE, matching the tunnel created in the Dashboard; both alternatives below name the interface X4B-Tunnel.

For IPIP (IP in IP):

/interface ipip
add disabled=no dscp=0 local-address=$LOCAL_ADDR mtu=1180 name=X4B-Tunnel \
    remote-address=$FILTER_ADDR

For GRE:

/interface gre
add disabled=no dscp=0 local-address=$LOCAL_ADDR mtu=1180 name=X4B-Tunnel \
    remote-address=$FILTER_ADDR

Step 4

Add the Tunnel IP addresses. These can be retrieved through the tunnel's Action > Information page.

/ip address
add address=$INTERNAL_ADDR[0]/30 disabled=no interface=X4B-Tunnel network=\
    $NETWORK

For example, use these assigned values when adapting the address command:

/ip address
add address=10.17.21.18/30 disabled=no interface=X4B-Tunnel network=\
    10.17.21.16 

Step 5

It may also be necessary to allow all IP addresses through the firewall.

/ip firewall filter
add action=accept chain=input disabled=no src-address=$FILTER_ADDR
add action=accept chain=output disabled=no dst-address=$FILTER_ADDR
add action=accept chain=input disabled=no dst-port=80 protocol=tcp

Step 6

Create port forwardings (NAT) on your side (My Web Server IP 192.168.0.7). This example forwards 80 (TCP), replace this as required.

/ip firewall nat
add action=dst-nat chain=dstnat disabled=no dst-address=10.17.21.18 dst-port=\
    80 in-interface=X4B-Tunnel protocol=tcp to-addresses=192.168.0.7 \
    to-ports=80

Step 7

Create your server IP address on /ip firewall address-list menu . Let 192.168.0.7 be the IP address of the webserver.

/ip firewall address-list
add address=192.168.0.7 disabled=no list=WEBSERVER

Step 8

Create Routing Mangle for IP Routing

/ip firewall mangle
add action=mark-routing chain=prerouting comment="X4B Routing Mangle" disabled=no \
    new-routing-mark=X4B passthrough=no src-address-list=WEBSERVER

Step 9

Finally Create Route for sending packets over the GRE tunnel.

/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=X4B-Tunnel routing-mark=X4B scope=30 target-scope=10

Check the completed configuration

Inspect the chosen interface, assigned address, NAT and marked route before testing connectivity:

/interface print detail where name="X4B-Tunnel"
/ip address print detail where interface="X4B-Tunnel"
/ip firewall nat print detail where in-interface="X4B-Tunnel"
/ip route print detail where routing-mark="X4B"

The interface must exist before Step 4 assigns its address. Check the local and remote tunnel addresses, the assigned subnet, and the X4B routing mark against your service. These checks inspect RouterOS configuration; successful traffic forwarding still requires validation on your router.