How to Configure LTE Bonding Using Public IP on Mikrotik

mamet zeroshell

January 01, 2024

To set up LTE bonding using public IPs on MikroTik with EoIP (Ethernet over IP), SSTP (Secure Socket Tunneling Protocol), and VRF (Virtual Routing and Forwarding), follow these steps:

1. Prepare LTE Interfaces

Ensure each LTE connection has a public IP assigned by your ISP.
Configure the LTE interfaces on your MikroTik router.

2. Set Up SSTP VPN

Configure an SSTP server on a remote MikroTik router or VPS with a public IP.
On your local MikroTik router, create SSTP client connections for each LTE interface to the remote server.

3. Create EoIP Tunnels

Set up EoIP tunnels between the local and remote MikroTik routers.
Assign unique tunnel IDs for each EoIP interface.
Use the public IPs of the SSTP server and client as the local and remote addresses for the EoIP tunnels.

4. Configure VRF (Virtual Routing and Forwarding)

Create separate VRF instances for each LTE connection to isolate routing tables.
Assign the EoIP interfaces to their respective VRF instances.
This ensures that traffic from each LTE connection is routed independently.

5. Bond EoIP Interfaces

Navigate to Interfaces > Bonding and create a bonding interface.
Add the EoIP interfaces to the bonding group.
Use a bonding mode like balance-rr (round-robin) or 802.3ad for load balancing.

6. Routing Configuration

Set up routing rules to direct traffic through the bonded interface.
Ensure proper NAT rules are in place for outgoing traffic.

7. Test and Monitor

Verify that traffic is being distributed across the LTE connections.
Test failover by disconnecting one LTE interface and ensuring traffic continues through the others.

In the example, we have 4 LTE interfaces, and connect to 4 public IPs via EOIP Tunel using SSTP VPN, because each LTE user gets the same IP and gateway, we use VRF.


# VRF configuration for each LTE
/interface vrf
add name=vrf-lte1 interface=lte1
add name=vrf-lte2 interface=lte2
add name=vrf-lte3 interface=lte3
add name=vrf-lte4 interface=lte4

# Configure EOIP Tunnel for each LTE
/interface eoip
add name=eoip-lte1 local-address=192.168.8.100 remote-address=103.11.22.33 tunnel-id=1
add name=eoip-lte2 local-address=192.168.8.100 remote-address=103.11.22.34 tunnel-id=2
add name=eoip-lte3 local-address=192.168.8.100 remote-address=103.11.22.35 tunnel-id=3
add name=eoip-lte4 local-address=192.168.8.100 remote-address=103.11.22.36 tunnel-id=4

# Configure SSTP VPN for each LTE
/interface sstp-client
add name=sstp-lte1 connect-to=103.11.22.33 user=user1 password=password1 add-default-route=no profile=default
add name=sstp-lte2 connect-to=103.11.22.34 user=user2 password=password2 add-default-route=no profile=default
add name=sstp-lte3 connect-to=103.11.22.35 user=user3 password=password3 add-default-route=no profile=default
add name=sstp-lte4 connect-to=103.11.22.36 user=user4 password=password4 add-default-route=no profile=default

# Configure IP Address for each SSTP VPN
/ip address
add address=172.16.128.2/30 interface=sstp-lte1
add address=172.16.128.3/30 interface=sstp-lte2
add address=172.16.128.4/30 interface=sstp-lte3
add address=172.16.128.5/30 interface=sstp-lte4

# Static Route configuration for each LTE
/ip route
add dst-address=172.16.128.2 gateway=sstp-lte1 routing-mark=vrf-lte1
add dst-address=172.16.128.3 gateway=sstp-lte1 routing-mark=vrf-lte2
add dst-address=172.16.128.4 gateway=sstp-lte1 routing-mark=vrf-lte3
add dst-address=172.16.128.5 gateway=sstp-lte1 routing-mark=vrf-lte4

# Configure Routing Mark for each VRF
/ip firewall mangle
add chain=prerouting in-interface=lte1 action=mark-routing new-routing-mark=vrf-lte1
add chain=prerouting in-interface=lte2 action=mark-routing new-routing-mark=vrf-lte2
add chain=prerouting in-interface=lte3 action=mark-routing new-routing-mark=vrf-lte3
add chain=prerouting in-interface=lte4 action=mark-routing new-routing-mark=vrf-lte4

# Bonding Interface Configuration
/interface bonding
add name=bond1 slaves=eoip-lte1,eoip-lte2,eoip-lte3,eoip-lte4 mode=balance-rr

# NAT configuration for bonding
/ip firewall nat
add chain=srcnat out-interface=bond1 action=masquerade