How to Configure VPLS on MikroTik (Step-by-Step)

If you’ve ever needed to connect multiple remote offices as if they were on the same Ethernet switch, VPLS on MikroTik is exactly what you’re looking for. It lets you build a seamless Layer 2 network over long distances using MPLS no NAT, no routing complexity, just a transparent Ethernet bridge between sites.

In this guide, I’ll walk you through how to configure VPLS on MikroTik step by step.

What is VPLS?

VPLS creates a Layer 2 multipoint Ethernet service across WAN by encapsulating Ethernet frames over MPLS.

The full name is Virtual Private LAN Service, and it basically lets you build a virtual Ethernet network across cities, countries wherever your sites are. It’s great for cases where you need broadcast domains or want to bridge networks without changing IP addressing. MikroTik happens to support it pretty well, so let’s dive into the setup.

How to Setup VPLS on Mikrotik

Before jumping into VPLS, make sure you’ve already set up MPLS VPLS builds on top of that. (If you haven’t, check out our MPLS setup guide).

The idea here is to create tunnel interfaces between your routers that act like direct Ethernet links, even if they’re across the internet. We’re going to connect:

R1 ↔ R5 (Customer A)

R1 ↔ R4 (Customer A)

R4 ↔ R5 (Customer A)

R1 ↔ R5 (Customer B)

For each of these, you’ll configure a VPLS interface on both sides. MikroTik uses LDP to handle label distribution. Each packet carries two MPLS labels one for the tunnel itself, and another for transport.

You’ll be working inside the /interface vpls menu. Just make sure to give each tunnel a unique vpls-id so they don’t overlap.

Required Setups

• On R1:

/interface vpls add name=A1toA2 remote-peer=9.9.9.5 mac-address=00:00:00:00:00:a1 vpls-id=10 disabled=no

/interface vpls add name=A1toA3 remote-peer=9.9.9.4 mac-address=00:00:00:00:00:a1 vpls-id=10 disabled=no

/interfacevpls add name=B1toB2 remote-peer=9.9.9.5 mac-address=00:00:00:00:00:b1 vpls-id=11 disabled=no

• On R4:

/interface vpls add name=A3toA1 remote-peer=9.9.9.1 mac-address=00:00:00:00:00:a3 vpls-id=10 disabled=no

/interface vpls add name=A3toA2 remote-peer=9.9.9.5 mac-address=00:00:00:00:00:a3 vpls-id=10 disabled=no

• On R5: 

/interface vpls add name=A2toA1 remote-peer=9.9.9.1 mac-address=00:00:00:00:00:a2 vpls-id=10 disabled=no

/interface vpls add name=A2toA3 remote-peer=9.9.9.4 mac-address=00:00:00:00:00:a2 vpls-id=10 disabled=no

/interface vpls add name=B2toB1 remote-peer=9.9.9.1 mac-address=00:00:00:00:00:b2 vpls-id=11 disabled=n

Bridging Ethernet Segments with VPLS

Once the VPLS tunnel between R1 and R5 is up, bridging is pretty simple. You just create a bridge interface and add your physical and VPLS interfaces to it. No tricks involved it’s just standard bridging between the physical and VPLS interfaces.

On R1:

/interface bridge add name=B

/interface bridge port add bridge=B interface=ether1

/interface bridge port add bridge=B interface=B1toB2

And on R5:

/interface bridge add name=B

/interface bridge port add bridge=B interface=ether3

/interface bridge port add bridge=B interface=B2toB1

Since there’s only one VPLS tunnel between R1 and R5, you don’t need to enable STP or RSTP. There’s no risk of a loop, so keep it simple. The bridge just acts like a direct Ethernet link between the two ends fast and transparent.

Bridge Horizon Setup

If you’re using VPLS tunnels in a full mesh, You’ll quickly run into a common issue: broadcast loops. Broadcasts or unknown MACs get flooded everywhere and if one router sends it back into another tunnel, it can lead to serious traffic loops.

To stop that, MikroTik has a handy feature called bridge horizon. It’s simple: packets from one VPLS tunnel don’t get forwarded into another if both have the same horizon value.

Here’s how to apply it. Let’s say you’ve got R1, R4, and R5 all part of Customer A’s network. On R1, you’d do:

/interface bridge add name=A

/interface bridge port add bridge=A interface=A1toA2 horizon=1

/interface bridge port add bridge=A interface=A1toA3 horizon=1

Repeat something similar on R4 and R5. Just don’t assign a horizon to the physical Ethernet port (like ether1), or it’ll break forwarding.

One thing to know: horizon values don’t need to match across routers. They’re only checked locally, per device.

And that’s it no loops, no complex protocols like STP just clean and efficient VPLS bridging.

Conclusion

So, that’s the VPLS setup on MikroTik. It’s not the simplest config you’ll ever do but once the tunnels are in place and labels are doing their job, it really does feel like magic. If you’re testing this in a lab, perfect. If it’s production double-check everything.

Missed a step? Something didn’t work? Been there. Feel free to leave a comment below or reach out if you run into issues.

Hope this walkthrough saved you some headaches.